# CA Owner Audit Dump - Government of The Netherlands, PKIoverheid (Logius)

Generated: 2026-07-28T06:56:22.041358Z

## CA Owner Summary

- Name: Government of The Netherlands, PKIoverheid (Logius)
- Country: Netherlands
- Website: -
- Problem Reporting: KPN, contact pkivalidation[at]kpn[dot]com., QuoVadis contact support[at]quovadisglobal[dot]com (Phone +31(0)302324320 during office hours or +16512293456 outside office hours)., Digidentity, security[at]digidentity[dot]com, or call +31 887787800., For CAs not listed above, general issues or issues with multiple CAs, contact pkioverheid[at]logius[dot]nl.
- CP/CPS URLs: https://cp.pkioverheid.nl, https://cps.pkioverheid.nl, https://www.logius.nl/languages/english/pkioverheid/, https://cps.pkioverheid.nl/pkioverheid-cps-unified-v5.5.pdf, https://www.logius.nl/english/pkioverheid/, https://pki.cleverbase.com/cps.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.3.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.1.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf, https://www.digidentity.eu/assets/files/terms/2019v2-CPS-PKIo.pdf, https://www.digidentity.eu/api/media/file/2025-v1_CPS_PKIoverheid_(sealed).pdf, https://www.digidentity.eu/assets/files/cps_en_pds/CPS_Digidentity_v1.2.pdf, https://www.digidentity.eu/assets/files/cps_en_pds/2020-v3-CPS-PKIo.pdf, https://www.digidentity.eu/assets/files/terms/2020-v1-CPS-PKIo.pdf, https://assets.ctfassets.net/f8kgzjsvnt2r/2QsrWnpw0hV3Cl1coV359N/45a1a9732b8ef32bfcf039066ba9e010/2022-v1_CPS_PKIoverheid__signed_DDY_.pdf, https://www.de-electronische-signatuur.nl/content/bestanden/pdf/cps-7.7-en.pdf, https://www.de-electronische-signatuur.nl/nl/certification-practice-statement, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.1.html, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.13.pdf, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.4_English.pdf, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.1_English.pdf, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_EVSSL_v1.3.1.pdf, https://www.logius.nl/english/pkioverheid, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.9.pdf, http://bct.csp.minienm.nl/minienm-bct-cps/minienm-bct-cps.pdf, http://bct.csp.minienm.nl/, https://cps.dp.ca.mindef.nl/2019-10-17_CPS_G2_Certification_Authority_Ministry_of_Defence_v2.10.3_EN..._DO_AvdS.pdf, https://cps.ca.pkidefensie.nl/cps-mindef.pdf, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203e%20Server%20V1.9.ashx, https://www.quovadisglobal.nl/Repository.aspx?sc_lang=en-GB, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Burger%203c%20V1.3.ashx, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Burger%203c%20V1.7.ashx, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_EV%203F%20V1.7.ashx, https://www.digicert.com/content/dam/digicert/pdfs/legal/quovadis/digicert-pkioverheid-cps-v2-02-en.pdf, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_PKIo_CPS%20v1.5_final.ashx, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203b%20Service%20V1.4.ashx, https://www.quovadisglobal.com/wp-content/uploads/2022/06/QV_PKIo_CPS-v1.13_Approved.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf, https://www.zorgcsp.nl/Media/Default/documenten/English%20version%20(UZI-register).pdf, https://www.zorgcsp.nl/Media/Default/documenten/RK1.CPS%20ZOVAR%20v3%201%20definitief.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=16e4b8af-42a8-4c8a-9cdf-046c1d1fe084, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f1048ccf-61e3-4baf-ae58-3a8e2868482e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3a975fc0-437e-4c9e-bfba-d1cd1290cbd2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5a1fb183-df20-4120-aea5-25195aa33c9c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=64c4350a-9a42-49a8-af88-547fc0af698e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6c00448f-0a9e-4512-8365-859b4287c77d, https://cert.webtrust.org/SealFile?seal=2010&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=927abf07-9ac0-45e1-a3dc-d9c44455afa3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c139d1a2-2273-4611-88fe-b595164b7d48, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4a0c4b36-3557-4e77-847e-3269b2c85a88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b165e05-5231-48c7-8b41-fa7c65f1535f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=35d0c242-b7c1-4d9c-9368-ac6de3573ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f096c89-87b2-43d8-8e57-9d5046473053, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/clever-0047635206-000/ets_056.pdf, https://bug2036713.bmoattachments.org/attachment.cgi?id=9581397, https://pceb.tayllorcox.cz/files/DIGICERT_AAL_2025_SMIME-BR_Audit_v2_signed.pdf, https://www.digidentity.eu/assets/files/terms/20200123-ETS043-411-1.pdf, https://attestic.eu/wp-content/uploads/2026/01/CT-004-Digidentity-Certificate-2026-01-ETSI-319-411-1_v1.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9045690, https://www.digidentity.eu/assets/files/terms/20200603-ETS043-ETSI411-1.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9198662, https://bugzilla.mozilla.org/attachment.cgi?id=8970852, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/digide-0047403032-000/ecertificate_-_ets_043.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9073165, https://www.de-electronische-signatuur.nl/content/bestanden/documenten/ETS047-2.pdf, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ets_029.pdf, https://bug1434881.bmoattachments.org/attachment.cgi?id=9173298, https://bugzilla.mozilla.org/attachment.cgi?id=9090451, https://bugzilla.mozilla.org/attachment.cgi?id=8746607, https://bugzilla.mozilla.org/attachment.cgi?id=8970536, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ecertificate_-_ets_029.pdf, https://bct.tsp.minienw.nl/ETS034MinIenW.pdf, http://csp.minienm.nl/ETS034MinIenM.pdf, https://cps.dp.ca.mindef.nl/certificeringen/ETS%20044.pdf, https://attestic.eu/wp-content/uploads/2026/02/CT-014-Mindef-2026-02-Certificate-ETSI-319-411-1-v1.pdf, https://www.quovadisglobal.nl/~/media/Files/Files_Global/QuoVadis_ETS_030.ashx, https://www.quovadisglobal.nl/Bedrijfsinformatie/Accreditaties.aspx, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9198675, https://www.quovadisglobal.nl/~/media/Files/Files_Global/ETS%20010%20eCertificate.ashx, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ecertificate_-_ets_030.pdf, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9114853
- Root Programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Not Included","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: KPN, contact pkivalidation[at]kpn[dot]com., QuoVadis contact support[at]quovadisglobal[dot]com (Phone +31(0)302324320 during office hours or +16512293456 outside office hours)., Digidentity, security[at]digidentity[dot]com, or call +31 887787800., For CAs not listed above, general issues or issues with multiple CAs, contact pkioverheid[at]logius[dot]nl.
- CP/CPS URLs: https://cp.pkioverheid.nl, https://cps.pkioverheid.nl, https://www.logius.nl/languages/english/pkioverheid/, https://cps.pkioverheid.nl/pkioverheid-cps-unified-v5.5.pdf, https://www.logius.nl/english/pkioverheid/, https://pki.cleverbase.com/cps.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.3.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.1.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf, https://www.digidentity.eu/assets/files/terms/2019v2-CPS-PKIo.pdf, https://www.digidentity.eu/api/media/file/2025-v1_CPS_PKIoverheid_(sealed).pdf, https://www.digidentity.eu/assets/files/cps_en_pds/CPS_Digidentity_v1.2.pdf, https://www.digidentity.eu/assets/files/cps_en_pds/2020-v3-CPS-PKIo.pdf, https://www.digidentity.eu/assets/files/terms/2020-v1-CPS-PKIo.pdf, https://assets.ctfassets.net/f8kgzjsvnt2r/2QsrWnpw0hV3Cl1coV359N/45a1a9732b8ef32bfcf039066ba9e010/2022-v1_CPS_PKIoverheid__signed_DDY_.pdf, https://www.de-electronische-signatuur.nl/content/bestanden/pdf/cps-7.7-en.pdf, https://www.de-electronische-signatuur.nl/nl/certification-practice-statement, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf, https://cp.pkioverheid.nl/pkioverheid-por-v5.1.html, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.13.pdf, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.4_English.pdf, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.1_English.pdf, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_EVSSL_v1.3.1.pdf, https://www.logius.nl/english/pkioverheid, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.9.pdf, http://bct.csp.minienm.nl/minienm-bct-cps/minienm-bct-cps.pdf, http://bct.csp.minienm.nl/, https://cps.dp.ca.mindef.nl/2019-10-17_CPS_G2_Certification_Authority_Ministry_of_Defence_v2.10.3_EN..._DO_AvdS.pdf, https://cps.ca.pkidefensie.nl/cps-mindef.pdf, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203e%20Server%20V1.9.ashx, https://www.quovadisglobal.nl/Repository.aspx?sc_lang=en-GB, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Burger%203c%20V1.3.ashx, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Burger%203c%20V1.7.ashx, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_EV%203F%20V1.7.ashx, https://www.digicert.com/content/dam/digicert/pdfs/legal/quovadis/digicert-pkioverheid-cps-v2-02-en.pdf, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_PKIo_CPS%20v1.5_final.ashx, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203b%20Service%20V1.4.ashx, https://www.quovadisglobal.com/wp-content/uploads/2022/06/QV_PKIo_CPS-v1.13_Approved.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf, https://www.zorgcsp.nl/Media/Default/documenten/English%20version%20(UZI-register).pdf, https://www.zorgcsp.nl/Media/Default/documenten/RK1.CPS%20ZOVAR%20v3%201%20definitief.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=16e4b8af-42a8-4c8a-9cdf-046c1d1fe084, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f1048ccf-61e3-4baf-ae58-3a8e2868482e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3a975fc0-437e-4c9e-bfba-d1cd1290cbd2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5a1fb183-df20-4120-aea5-25195aa33c9c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=64c4350a-9a42-49a8-af88-547fc0af698e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6c00448f-0a9e-4512-8365-859b4287c77d, https://cert.webtrust.org/SealFile?seal=2010&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=927abf07-9ac0-45e1-a3dc-d9c44455afa3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c139d1a2-2273-4611-88fe-b595164b7d48, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4a0c4b36-3557-4e77-847e-3269b2c85a88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b165e05-5231-48c7-8b41-fa7c65f1535f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=35d0c242-b7c1-4d9c-9368-ac6de3573ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f096c89-87b2-43d8-8e57-9d5046473053, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/clever-0047635206-000/ets_056.pdf, https://bug2036713.bmoattachments.org/attachment.cgi?id=9581397, https://pceb.tayllorcox.cz/files/DIGICERT_AAL_2025_SMIME-BR_Audit_v2_signed.pdf, https://www.digidentity.eu/assets/files/terms/20200123-ETS043-411-1.pdf, https://attestic.eu/wp-content/uploads/2026/01/CT-004-Digidentity-Certificate-2026-01-ETSI-319-411-1_v1.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9045690, https://www.digidentity.eu/assets/files/terms/20200603-ETS043-ETSI411-1.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9198662, https://bugzilla.mozilla.org/attachment.cgi?id=8970852, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/digide-0047403032-000/ecertificate_-_ets_043.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9073165, https://www.de-electronische-signatuur.nl/content/bestanden/documenten/ETS047-2.pdf, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ets_029.pdf, https://bug1434881.bmoattachments.org/attachment.cgi?id=9173298, https://bugzilla.mozilla.org/attachment.cgi?id=9090451, https://bugzilla.mozilla.org/attachment.cgi?id=8746607, https://bugzilla.mozilla.org/attachment.cgi?id=8970536, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ecertificate_-_ets_029.pdf, https://bct.tsp.minienw.nl/ETS034MinIenW.pdf, http://csp.minienm.nl/ETS034MinIenM.pdf, https://cps.dp.ca.mindef.nl/certificeringen/ETS%20044.pdf, https://attestic.eu/wp-content/uploads/2026/02/CT-014-Mindef-2026-02-Certificate-ETSI-319-411-1-v1.pdf, https://www.quovadisglobal.nl/~/media/Files/Files_Global/QuoVadis_ETS_030.ashx, https://www.quovadisglobal.nl/Bedrijfsinformatie/Accreditaties.aspx, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9198675, https://www.quovadisglobal.nl/~/media/Files/Files_Global/ETS%20010%20eCertificate.ashx, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ecertificate_-_ets_030.pdf, https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=9114853
- Repository URLs: https://cps.pkioverheid.nl/, https://cp.pkioverheid.nl, https://www.digidentity.eu/cps_en_pds/, https://www.digidentity.eu/en/home/#downloads, https://www.digidentity.eu/en/documentation/, https://certificaat.kpn.com, https://certificaat.kpn.com/support/downloads/repository/, https://certificaat.kpn.com/elektronische-opslagplaats/repository/, https://certificaat.kpn.com/, https://www.logius.nl/languages/english/pkioverheid/, http://cps.dp.ca.mindef.nl/ips/cps-en.jsp
- Root programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Not Included","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden - G4 Root Publ G-SMIME - 2024 | yes | unknown | 2024-05-23 to 2039-05-20 | - | - | - | current errors: 1 |
| 2 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA | yes | expired | 2010-12-08 to 2022-12-08 | - | - | - | clean |
| 3 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA | yes | expired | 2002-12-17 to 2015-12-16 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 4 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G2 | yes | expired | 2008-03-26 to 2020-03-25 | 2.5.29.32.0 | - | - | clean |
| 5 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3 | yes | unknown | 2013-11-14 to 2028-11-13 | - | - | - | clean |
| 6 | countryName=NL, organizationName=Cleverbase ID B.V., organizationIdentifier=NTRNL-67419925, commonName=Cleverbase ID PKIoverheid Burger CA - G3 | yes | revoked | 2018-01-25 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 7 | countryName=NL, organizationName=Cleverbase ID B.V., organizationIdentifier=NTRNL-67419925, commonName=Cleverbase ID PKIoverheid Burger CA - G3 | yes | current | 2019-04-17 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 8 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=DigiCert QuoVadis PKIoverheid Burger CA - 2023 | yes | current | 2023-03-20 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 9 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=DigiCert QuoVadis PKIoverheid Organisatie Persoon CA - 2023 | yes | current | 2023-03-20 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 10 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=DigiCert QuoVadis PKIoverheid Organisatie Services CA - 2023 | yes | current | 2023-03-20 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7, 0.4.0.2042.1.2, 0.4.0.194112.1.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 11 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Burger CA - G2 | yes | expired | 2011-04-06 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 12 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Burger CA - 2021 | yes | current | 2021-02-25 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 13 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Burger CA - G3 | yes | revoked | 2018-05-17 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 14 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Burger CA - G3 | yes | revoked | 2019-04-17 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 15 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Persoon CA - G3 | yes | current | 2019-04-17 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 16 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Persoon CA - G3 | yes | revoked | 2018-05-17 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 17 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2018-05-17 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 18 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2019-04-17 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 19 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Services CA - 2021 | yes | current | 2021-02-25 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 20 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Services CA - G3 | yes | revoked | 2018-05-17 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 21 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Organisatie CA - G2 | yes | expired | 2011-04-06 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 22 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Burger CA - G3 | yes | revoked | 2018-03-22 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 23 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Organisatie Persoon CA - G3 | yes | revoked | 2018-03-22 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 24 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2018-03-22 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 25 | countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Organisatie Services CA - G3 | yes | revoked | 2018-03-22 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 26 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity PKIoverheid Server CA 2020 | yes | revoked, expired | 2020-07-28 to 2022-12-05 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 27 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity PKIoverheid Server CA 2020 | yes | revoked, expired | 2020-07-29 to 2022-12-05 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 28 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Services CA - G2 | yes | revoked, expired | 2011-05-03 to 2020-03-20 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 29 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Services CA - G2 | yes | expired | 2011-09-27 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 30 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity SSCD CA - G2 | yes | expired | 2011-09-27 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 31 | countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity SSCD CA - G2 | yes | revoked, expired | 2011-05-03 to 2020-03-23 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 32 | countryName=NL, organizationName=DigiNotar B.V., commonName=DigiNotar PKIoverheid CA Organisatie - G2 | yes | revoked, expired | 2010-05-12 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 33 | countryName=NL, organizationName=ESG de Electronische Signatuur B.V., commonName=ESG Burger CA - G2 | yes | expired | 2012-12-19 to 2020-03-23 | 2.5.29.32.0 | - | - | historical errors: 3 |
| 34 | countryName=NL, organizationName=ESG de electronische signatuur BV, commonName=ESG CA - G2 | yes | revoked, expired | 2009-07-14 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 35 | countryName=NL, organizationName=ESG de Electronische Signatuur B.V., commonName=ESG Organisatie CA - G2 | yes | expired | 2012-12-19 to 2020-03-23 | 2.5.29.32.0 | - | - | historical errors: 3 |
| 36 | countryName=NL, organizationName=ESG de electronische signatuur BV, commonName=ESG Persoonlijk CA - G2 | yes | revoked, expired | 2010-02-16 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 37 | countryName=NL, organizationName=ESG de electronische signatuur BV, commonName=ESG Persoonlijk CA – G2 | yes | revoked, expired | 2009-12-16 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 38 | countryName=NL, organizationName=Getronics Nederland BV, commonName=Getronics CSP Justitie CA - G2 | yes | expired | 2010-05-18 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 39 | countryName=NL, organizationName=Getronics Nederland BV, commonName=Getronics CSP Organisatie CA - G2 | yes | revoked, expired | 2009-12-16 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 40 | countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Persoon CA - G3 | yes | current | 2016-12-08 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 41 | countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2016-12-08 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 42 | countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2019-04-16 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 43 | countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Services CA - G3 | yes | current | 2016-12-08 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 44 | countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN CM PKIoverheid EV CA | yes | revoked, expired | 2015-10-21 to 2022-12-05 | 2.16.528.1.1003.1.2.7 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 45 | countryName=NL, organizationName=KPN Corporate Market BV, commonName=KPN Corporate Market CSP Justitie CA - G2 | yes | expired | 2012-02-28 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 46 | countryName=NL, organizationName=KPN Corporate Market BV, commonName=KPN Corporate Market CSP Organisatie CA - G2 | yes | expired | 2012-02-08 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 47 | countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN Corporate Market CSP Organisatie Services CA - G3 | yes | revoked | 2013-11-14 to 2028-11-11 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.6 | 0 | - | historical errors: 1 |
| 48 | countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid EV CA | yes | revoked, expired | 2015-03-05 to 2022-12-05 | 2.16.528.1.1003.1.2.7 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 4 |
| 49 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid EV CA | yes | expired | 2016-03-03 to 2022-12-05 | 2.16.528.1.1003.1.2.7 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 50 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie CA - G2 | yes | expired | 2016-04-12 to 2020-03-23 | 2.5.29.32.0 | 0 | - | historical errors: 2 |
| 51 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie CA - G2 | yes | revoked, expired | 2016-03-03 to 2020-03-23 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 2 |
| 52 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie CA - G2 | yes | revoked, expired | 2016-04-08 to 2020-03-23 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | - | historical errors: 2 |
| 53 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie Persoon CA - G3 | yes | revoked | 2015-11-25 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 2 |
| 54 | countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid Organisatie Persoon CA - G3 | yes | revoked | 2015-03-12 to 2028-11-11 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 2 |
| 55 | countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2015-03-12 to 2028-11-11 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 4 |
| 56 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2015-11-25 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 57 | countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid Organisatie Services CA - G3 | yes | revoked | 2015-03-12 to 2028-11-11 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 2 |
| 58 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie Services CA - G3 | yes | revoked | 2015-11-25 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5 | 0 | TLS Web Client Authentication, E-mail Protection, OCSP Signing | historical errors: 2 |
| 59 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Server CA 2020 | yes | expired | 2020-07-29 to 2022-12-05 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 60 | countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Server CA 2020 | yes | revoked, expired | 2020-07-28 to 2022-12-05 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 61 | countryName=NL, organizationName=Digidentity B.V., commonName=MachtigingOnline SSCD CA - G2 | yes | revoked, expired | 2011-05-03 to 2020-03-20 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 62 | countryName=NL, organizationName=Digidentity B.V., commonName=MachtigingOnline SSCD CA - G2 | yes | expired | 2011-09-27 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 63 | countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Autonome Apparaten CA - G2 | yes | expired | 2012-03-08 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 64 | countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Organisatie CA - G2 | yes | expired | 2012-03-08 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 65 | countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Taxi CA Boordcomputerkaarten - G2 | yes | expired | 2012-03-09 to 2020-03-21 | 2.5.29.32.0 | - | - | clean |
| 66 | countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Taxi CA Systeemkaarten - G2 | yes | expired | 2012-03-09 to 2020-03-21 | 2.5.29.32.0 | - | - | clean |
| 67 | countryName=NL, organizationName=Ministerie van Infrastructuur en Waterstaat, organizationIdentifier=NTRNL-52766179, commonName=MinIenW PKIoverheid Organisatie Persoon CA - G3 | yes | revoked | 2019-02-28 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 68 | countryName=NL, organizationName=Ministerie van Infrastructuur en Waterstaat, organizationIdentifier=NTRNL-52766179, commonName=MinIenW PKIoverheid Organisatie Services CA - G3 | yes | revoked | 2019-02-28 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 69 | countryName=NL, organizationName=Ministerie van Defensie, commonName=Ministerie van Defensie Certificatie Autoriteit - G2 | yes | expired | 2010-11-10 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 70 | countryName=NL, organizationName=Ministerie van Defensie, commonName=Ministerie van Defensie Certificatie Autoriteit Defensiepas - G2 | yes | expired | 2010-11-16 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 71 | countryName=NL, organizationName=Ministerie van Defensie, organizationIdentifier=NTRNL-27370985, commonName=Ministerie van Defensie PKIoverheid Organisatie Persoon CA - G3 | yes | current | 2019-06-27 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 72 | countryName=NL, organizationName=QuoVadis Trustlink BV, organizationalUnitName=Issuing Certification Authority, commonName=QuoVadis CSP - PKI Overheid CA - G2 | yes | expired | 2009-07-14 to 2020-03-23 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 73 | countryName=NL, organizationName=QuoVadis Trustlink BV, commonName=QuoVadis CSP - PKI Overheid EV CA | yes | revoked, expired | 2012-12-13 to 2022-12-06 | 2.16.528.1.1003.1.2.7 | 0 | - | historical errors: 2 |
| 74 | countryName=NL, organizationName=QuoVadis Trustlink BV, commonName=QuoVadis CSP Burger CA - G2 | yes | revoked, expired | 2014-04-09 to 2020-03-23 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | - | clean |
| 75 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Burger CA - 2021 | yes | revoked | 2021-02-25 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 76 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Burger CA - G3 | yes | revoked | 2016-11-03 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 77 | countryName=NL, organizationName=QuoVadis Trustlink BV, commonName=QuoVadis PKIoverheid EV CA | yes | expired | 2015-03-05 to 2022-12-05 | 2.16.528.1.1003.1.2.7 | 0 | TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing | historical errors: 3 |
| 78 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Persoon CA - 2022 | yes | revoked | 2022-01-27 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 79 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Persoon CA - G3 | yes | current | 2016-11-03 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 80 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2016-11-03 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 81 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Server CA - G3 | yes | revoked | 2019-04-17 to 2028-11-12 | 2.16.528.1.1003.1.2.5.6 | 0 | TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication | historical errors: 1 |
| 82 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Services CA - 2022 | yes | current | 2022-01-27 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7, 0.4.0.2042.1.2, 0.4.0.194112.1.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 83 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Services CA - G3 | yes | revoked | 2016-11-03 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | historical errors: 1 |
| 84 | countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Services CA - G3 | yes | current | 2016-11-03 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 85 | countryName=NL, organizationName=QuoVadis Trustlink B.V., commonName=QuoVadis PKIoverheid Server CA 2020 | yes | expired | 2020-07-29 to 2022-12-05 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 86 | countryName=NL, organizationName=QuoVadis Trustlink B.V., commonName=QuoVadis PKIoverheid Server CA 2020 | yes | revoked, expired | 2020-07-28 to 2022-12-05 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 87 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Autonome Apparaten CA - G2 | yes | expired | 2009-11-03 to 2020-03-24 | 2.5.29.32.0 | - | - | clean |
| 88 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Autonome Apparaten CA - G3 | yes | current | 2013-11-15 to 2028-11-12 | 2.16.528.1.1003.1.2.6.1, 2.16.528.1.1003.1.2.6.2, 2.16.528.1.1003.1.2.6.3 | - | - | current errors: 2 |
| 89 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2 | yes | expired | 2008-03-31 to 2020-03-24 | 2.5.29.32.0 | - | - | clean |
| 90 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3 | yes | current | 2013-11-14 to 2028-11-12 | 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3 | - | - | current errors: 2 |
| 91 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Citizen CA - 2023 | yes | current | 2023-10-31 to 2028-11-13 | 2.16.528.1.1003.1.2.3.4, 2.16.528.1.1003.1.2.3.5, 2.16.528.1.1003.1.2.3.6, 0.4.0.194112.1.2, 0.4.0.2042.1.2 | - | 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 92 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020 | yes | revoked, expired | 2020-07-28 to 2022-12-06 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 93 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020 | yes | expired | 2020-07-29 to 2022-12-06 | 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 94 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA | yes | revoked, expired | 2010-12-08 to 2022-12-07 | 2.16.528.1.1003.1.2.7 | - | - | clean |
| 95 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA | yes | revoked, expired | 2014-02-27 to 2022-12-06 | 2.16.528.1.1003.1.2.7 | - | - | historical errors: 1 |
| 96 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2 | yes | expired | 2008-03-31 to 2020-03-24 | 2.5.29.32.0 | - | - | clean |
| 97 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3 | yes | current | 2013-11-14 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | - | - | current errors: 2 |
| 98 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3 | yes | current | 2013-11-14 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.6 | - | - | current errors: 1 |
| 99 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organization Person CA - 2023 | yes | current | 2023-10-31 to 2028-11-13 | 2.16.528.1.1003.1.2.5.10, 2.16.528.1.1003.1.2.5.11, 2.16.528.1.1003.1.2.5.12, 0.4.0.194112.1.2, 0.4.0.2042.1.2 | - | 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 100 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organization Services CA - 2023 | yes | current | 2023-10-31 to 2028-11-13 | 2.16.528.1.1003.1.2.5.13, 2.16.528.1.1003.1.2.5.14, 2.16.528.1.1003.1.2.5.15, 0.4.0.194112.1.3, 0.4.0.2042.1.2 | - | 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System | clean |
| 101 | countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden S/MIME CA - 2023 | yes | current | 2023-10-31 to 2028-11-13 | 2.16.528.1.1003.1.2.10.9, 2.16.528.1.1003.1.2.11.9, 2.16.528.1.1003.1.2.12.9, 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1 | - | E-mail Protection | clean |
| 102 | countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Medewerker niet op naam CA G21 | yes | revoked, expired | 2010-03-18 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 103 | countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker niet op naam CA G3 | yes | current | 2017-05-09 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 104 | countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker niet op naam CA G3 | yes | current | 2019-04-18 to 2028-11-12 | 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 105 | countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Medewerker op naam CA G21 | yes | expired | 2010-03-18 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 106 | countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker op naam CA G3 | yes | current | 2017-05-09 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 107 | countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker op naam CA G3 | yes | current | 2019-04-18 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 108 | countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Server CA G21 | yes | expired | 2010-03-18 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 109 | countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Zorgverlener CA G21 | yes | expired | 2010-03-18 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |
| 110 | countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Zorgverlener CA G3 | yes | current | 2017-05-09 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 111 | countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Zorgverlener CA G3 | yes | current | 2019-04-18 to 2028-11-12 | 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing | current errors: 1 |
| 112 | countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21 | yes | expired | 2010-03-16 to 2020-03-23 | 2.5.29.32.0 | - | - | clean |
| 113 | countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=ZOVAR Server CA G21 | yes | expired | 2010-03-18 to 2020-03-22 | 2.5.29.32.0 | - | - | clean |

## Certificate Details

### Staat der Nederlanden - G4 Root Publ G-SMIME - 2024

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden - G4 Root Publ G-SMIME - 2024
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden - G4 Root Publ G-SMIME - 2024
- Serial: 1A9F45E469541E927318319AEEDDB47B1B843A2E
- SHA-256: B80BF76624198A2D5D282068B49EF370AD901AB3A42897B628EFE6E6980B0A4E
- SPKI SHA-256: D2E4A365D9B2F4EB16C32A4C04CB07BC967DF3D74AD3606A432BB2207BA771D1
- Validity: 2024-05-23 to 2039-05-20
- Key: RSA 4096
- Signature Algorithm: RSASSA-PSS

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=16e4b8af-42a8-4c8a-9cdf-046c1d1fe084, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f1048ccf-61e3-4baf-ae58-3a8e2868482e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3a975fc0-437e-4c9e-bfba-d1cd1290cbd2
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/StaatderNederlandenG4RootPublGSMIME2024.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:9f:45:e4:69:54:1e:92:73:18:31:9a:ee:dd:b4:7b:1b:84:3a:2e
        Signature Algorithm: rsassaPss
        Hash Algorithm: sha512
        Mask Algorithm: mgf1 with sha512
         Salt Length: 0x40
        Trailer Field: 0x01 (default)
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden - G4 Root Publ G-SMIME - 2024
        Validity
            Not Before: May 23 11:27:17 2024 GMT
            Not After : May 20 11:27:16 2039 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden - G4 Root Publ G-SMIME - 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                9B:F8:80:4E:32:82:7E:71:25:C9:6E:BF:24:0E:59:AA:44:70:48:C9
            X509v3 Subject Key Identifier:
                9B:F8:80:4E:32:82:7E:71:25:C9:6E:BF:24:0E:59:AA:44:70:48:C9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: rsassaPss
    SHA256 Fingerprint: B80BF76624198A2D5D282068B49EF370AD901AB3A42897B628EFE6E6980B0A4E
    SPKI SHA256: D2E4A365D9B2F4EB16C32A4C04CB07BC967DF3D74AD3606A432BB2207BA771D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn e_signature_algorithm_not_supported: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Staat der Nederlanden EV Root CA

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA
- Serial: 98968D
- SHA-256: 4D2491414CFE956746EC4CEFA6CF6F72E28A1329432F9D8A907AC4CB5DADC15A
- SPKI SHA-256: 951EE046FA83316E6786C08C44F13B4CA2EAD2D2644D63314391C0CC70887D0D
- Validity: 2010-12-08 to 2022-12-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5a1fb183-df20-4120-aea5-25195aa33c9c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=64c4350a-9a42-49a8-af88-547fc0af698e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6c00448f-0a9e-4512-8365-859b4287c77d
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Removed","microsoft":"Removed","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000013 (0x98968d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
        Validity
            Not Before: Dec  8 11:19:29 2010 GMT
            Not After : Dec  8 11:10:28 2022 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FE:AB:00:90:98:9E:24:FC:A9:CC:1A:8A:FB:27:B8:BF:30:6E:A8:3B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4D2491414CFE956746EC4CEFA6CF6F72E28A1329432F9D8A907AC4CB5DADC15A
    SPKI SHA256: 951EE046FA83316E6786C08C44F13B4CA2EAD2D2644D63314391C0CC70887D0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- is_expired

### Staat der Nederlanden Root CA

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA
- Serial: 98968A
- SHA-256: D41D829E8C1659822AF93FCE62BFFCDE264FC84E8B950C5FF275D052354695A3
- SPKI SHA-256: 67EA193243AE383939B5AD9E356A6B2BF93A93BCDCF828A47082497883083F86
- Validity: 2002-12-17 to 2015-12-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2010&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000010 (0x98968a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA
        Validity
            Not Before: Dec 17 09:23:49 2002 GMT
            Not After : Dec 16 09:15:38 2015 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.pkioverheid.nl/policies/root-policy
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A8:7D:EB:BC:63:A4:74:13:74:00:EC:96:E0:D3:34:C1:2C:BF:6C:F8
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D41D829E8C1659822AF93FCE62BFFCDE264FC84E8B950C5FF275D052354695A3
    SPKI SHA256: 67EA193243AE383939B5AD9E356A6B2BF93A93BCDCF828A47082497883083F86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":false,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_basic_constraints_not_critical: Basic Constraints extension is marked as non-critical

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### Staat der Nederlanden Root CA - G2

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G2
- Serial: 98968C
- SHA-256: 668C83947DA63B724BECE1743C31A0E6AED0DB8EC5B31BE377BB784F91B6716F
- SPKI SHA-256: 05E77EF1FDFE05E2DCA522CAE64D8379A041B7B4F16C7CAE36067A7F72A14872
- Validity: 2008-03-26 to 2020-03-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=927abf07-9ac0-45e1-a3dc-d9c44455afa3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c139d1a2-2273-4611-88fe-b595164b7d48
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000012 (0x98968c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G2
        Validity
            Not Before: Mar 26 11:18:17 2008 GMT
            Not After : Mar 25 11:03:10 2020 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.pkioverheid.nl/policies/root-policy-G2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                91:68:32:87:15:1D:89:E2:B5:F1:AC:36:28:34:8D:0B:7C:62:88:EB
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 668C83947DA63B724BECE1743C31A0E6AED0DB8EC5B31BE377BB784F91B6716F
    SPKI SHA256: 05E77EF1FDFE05E2DCA522CAE64D8379A041B7B4F16C7CAE36067A7F72A14872
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### Staat der Nederlanden Root CA - G3

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 98A239
- SHA-256: 3C4FB0B95AB8B30032F432B86F535FE172C185D0FD39865837CF36187FA6F428
- SPKI SHA-256: 4223894003A881C5DF6BAB163DB235C221A18D54BF759945820E670DA82E3F39
- Validity: 2013-11-14 to 2028-11-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.pkioverheid.nl/pkioverheid-cps-unified-v5.5.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4a0c4b36-3557-4e77-847e-3269b2c85a88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b165e05-5231-48c7-8b41-fa7c65f1535f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=35d0c242-b7c1-4d9c-9368-ac6de3573ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0f096c89-87b2-43d8-8e57-9d5046473053
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Revocation status: -
- Browser status: {"apple":"Removed","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10003001 (0x98a239)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Nov 14 11:28:42 2013 GMT
            Not After : Nov 13 23:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3C4FB0B95AB8B30032F432B86F535FE172C185D0FD39865837CF36187FA6F428
    SPKI SHA256: 4223894003A881C5DF6BAB163DB235C221A18D54BF759945820E670DA82E3F39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Cleverbase ID PKIoverheid Burger CA - G3

- Subject: countryName=NL, organizationName=Cleverbase ID B.V., organizationIdentifier=NTRNL-67419925, commonName=Cleverbase ID PKIoverheid Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 5D23C4EEAE87F6E2
- SHA-256: 5C80E569FCEE93F15A2BC0435102B26A04F5AA1EC9912C13A05881C1AAD502D2
- SPKI SHA-256: 7375AA40D4E9F0D4B08FA02BE59DDB03374B0A42C686A197395A6CFE94BC04A3
- Validity: 2018-01-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cleverbase ID B.V.
- CP/CPS: https://www.logius.nl/english/pkioverheid/, https://pki.cleverbase.com/cps.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/clever-0047635206-000/ets_056.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6711424399121577698 (0x5d23c4eeae87f6e2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Jan 25 10:04:38 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Cleverbase ID B.V., organizationIdentifier = NTRNL-67419925, CN = Cleverbase ID PKIoverheid Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                F1:8E:69:8E:3E:4E:61:54:1A:CE:D6:92:94:D2:82:85:7D:FA:B9:40
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5C80E569FCEE93F15A2BC0435102B26A04F5AA1EC9912C13A05881C1AAD502D2
    SPKI SHA256: 7375AA40D4E9F0D4B08FA02BE59DDB03374B0A42C686A197395A6CFE94BC04A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cleverbase ID PKIoverheid Burger CA - G3

- Subject: countryName=NL, organizationName=Cleverbase ID B.V., organizationIdentifier=NTRNL-67419925, commonName=Cleverbase ID PKIoverheid Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 7796D55E296D01CCF50CEDB3707B0DD842695535
- SHA-256: DE0A92E5435B613208DC435ECC7158BF28F420A93E0A91D5965972053F523549
- SPKI SHA-256: 7375AA40D4E9F0D4B08FA02BE59DDB03374B0A42C686A197395A6CFE94BC04A3
- Validity: 2019-04-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cleverbase ID B.V.
- CP/CPS: https://pki.cleverbase.com/cps.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bug2036713.bmoattachments.org/attachment.cgi?id=9581397
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://pki.cleverbase.com/cleverbase3c.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:96:d5:5e:29:6d:01:cc:f5:0c:ed:b3:70:7b:0d:d8:42:69:55:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Apr 17 09:46:43 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Cleverbase ID B.V., organizationIdentifier = NTRNL-67419925, CN = Cleverbase ID PKIoverheid Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                F1:8E:69:8E:3E:4E:61:54:1A:CE:D6:92:94:D2:82:85:7D:FA:B9:40
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DE0A92E5435B613208DC435ECC7158BF28F420A93E0A91D5965972053F523549
    SPKI SHA256: 7375AA40D4E9F0D4B08FA02BE59DDB03374B0A42C686A197395A6CFE94BC04A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### DigiCert QuoVadis PKIoverheid Burger CA - 2023

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=DigiCert QuoVadis PKIoverheid Burger CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 271FC98D36A95D4D27BD914E9EDD9A4D28668061
- SHA-256: 66388EE649CBE920FD949FA9B77E2AA45B5DEC4120B8FFAB371B0C9C5E38C1C1
- SPKI SHA-256: 052F80B042E7DF6C02C8C3CCBE7F552A20CFFC4A062322027694C4DFF087AB18
- Validity: 2023-03-20 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.3.pdf; https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf; https://cp.pkioverheid.nl/pkioverheid-por-v5.1.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/DIGICERT_AAL_2025_SMIME-BR_Audit_v2_signed.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.digicert.eu/DigiCertQuoVadisPKIoverheidBurgerCA-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:1f:c9:8d:36:a9:5d:4d:27:bd:91:4e:9e:dd:9a:4d:28:66:80:61
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Mar 20 09:18:06 2023 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = DigiCert QuoVadis PKIoverheid Burger CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
                Policy: 0.4.0.2042.1.2
                Policy: 0.4.0.194112.1.2
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
            qcStatements:
                0.0...+.......0.......I..
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                76:AE:FA:CD:EC:F1:D7:7A:E8:AA:16:70:2A:24:F1:EE:3D:E8:F5:31
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 66388EE649CBE920FD949FA9B77E2AA45B5DEC4120B8FFAB371B0C9C5E38C1C1
    SPKI SHA256: 052F80B042E7DF6C02C8C3CCBE7F552A20CFFC4A062322027694C4DFF087AB18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### DigiCert QuoVadis PKIoverheid Organisatie Persoon CA - 2023

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=DigiCert QuoVadis PKIoverheid Organisatie Persoon CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 5568A88B2DC1C5FDC9230310D052B3E1A82335E2
- SHA-256: C8C77ECF368D73214D50D88384464339E6F8E59F34B47E39E7965F4E5787CF1D
- SPKI SHA-256: 302F714DE8BCA09F12003123A84A51F5FDB699EBE47B59D97ABA4005DE8DE880
- Validity: 2023-03-20 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.3.pdf; https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/DIGICERT_AAL_2025_SMIME-BR_Audit_v2_signed.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.digicert.eu/DigiCertQuoVadisPKIoverheidOrganisatiePersoonCA-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:68:a8:8b:2d:c1:c5:fd:c9:23:03:10:d0:52:b3:e1:a8:23:35:e2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Mar 20 09:02:52 2023 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = DigiCert QuoVadis PKIoverheid Organisatie Persoon CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.3
                Policy: 0.4.0.2042.1.2
                Policy: 0.4.0.194112.1.2
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
            qcStatements:
                0.0...+.......0.......I..
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                55:4B:AA:60:5F:FB:99:C8:91:8C:59:C2:74:3D:4C:27:AA:3D:79:A1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8C77ECF368D73214D50D88384464339E6F8E59F34B47E39E7965F4E5787CF1D
    SPKI SHA256: 302F714DE8BCA09F12003123A84A51F5FDB699EBE47B59D97ABA4005DE8DE880
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### DigiCert QuoVadis PKIoverheid Organisatie Services CA - 2023

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=DigiCert QuoVadis PKIoverheid Organisatie Services CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 79B8C261A12F7E86E7546E640E174EC90C2F58E1
- SHA-256: 6E25C0044C7EBB30D01A4CC3D5733D734D06CD296A6823E63527F4182D528351
- SPKI SHA-256: 77ACDCAA1CD3E6F1031A67B38A94D5D57520C30D7FD3E6E2899C4C17BE26E9E7
- Validity: 2023-03-20 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.3.pdf; https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf
- CP/CPS same as parent: false
- Audit URLs: https://pceb.tayllorcox.cz/files/DIGICERT_AAL_2025_SMIME-BR_Audit_v2_signed.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.digicert.eu/DigiCertQuoVadisPKIoverheidOrganisatieServicesCA-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7, 0.4.0.2042.1.2, 0.4.0.194112.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:b8:c2:61:a1:2f:7e:86:e7:54:6e:64:0e:17:4e:c9:0c:2f:58:e1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Mar 20 08:43:08 2023 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = DigiCert QuoVadis PKIoverheid Organisatie Services CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.5
                Policy: 2.16.528.1.1003.1.2.5.7
                Policy: 0.4.0.2042.1.2
                Policy: 0.4.0.194112.1.3
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
            qcStatements:
                0.0...+.......0.......I..
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                73:38:08:5F:66:BC:3B:C7:FF:FE:36:29:D7:05:FE:A0:72:19:AF:70
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6E25C0044C7EBB30D01A4CC3D5733D734D06CD296A6823E63527F4182D528351
    SPKI SHA256: 77ACDCAA1CD3E6F1031A67B38A94D5D57520C30D7FD3E6E2899C4C17BE26E9E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7, 0.4.0.2042.1.2, 0.4.0.194112.1.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity Burger CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Burger CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2
- Serial: 0131387F
- SHA-256: FCCC115022CE66FD106511E376F439C865E54A485040E633C2996945CEABEA01
- SPKI SHA-256: 2A94DE374C572CB5E4B1F49E3C39FD030640219A0FBA7A7BBB96A43461021956
- Validity: 2011-04-06 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/terms/2019v2-CPS-PKIo.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.digidentity.eu/assets/files/terms/20200123-ETS043-411-1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002943 (0x131387f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G2
        Validity
            Not Before: Apr  6 09:31:01 2011 GMT
            Not After : Mar 23 10:29:46 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity Burger CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:91:A5:0D:DD:1D:A0:D1:2A:68:A7:1B:8D:DB:48:9A:AA:34:A9:7F:96
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                0F:12:1F:4D:F9:C4:E5:52:24:D0:E2:14:AB:BA:18:0E:1D:58:79:EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FCCC115022CE66FD106511E376F439C865E54A485040E633C2996945CEABEA01
    SPKI SHA256: 2A94DE374C572CB5E4B1F49E3C39FD030640219A0FBA7A7BBB96A43461021956
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Digidentity BV PKIoverheid Burger CA - 2021

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Burger CA - 2021
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: F24B00C8F2953175EC1B78BB699EAC58759B13
- SHA-256: 9C64E24D2CAAA8DD45EF99BA62277CEEE6005C663624514B8C770E2D075BB611
- SPKI SHA-256: 579EF7B314FCCAEF45413ECF6A29A62C9ABAD584A6EE0810193A92E0B0468EED
- Validity: 2021-02-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.digidentity.eu/api/media/file/2025-v1_CPS_PKIoverheid_(sealed).pdf
- CP/CPS same as parent: false
- Audit URLs: https://attestic.eu/wp-content/uploads/2026/01/CT-004-Digidentity-Certificate-2026-01-ETSI-319-411-1_v1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid-g3.digidentity-pki.com/Digidentity-BV-PKIoverheid-Burger-CA-2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f2:4b:00:c8:f2:95:31:75:ec:1b:78:bb:69:9e:ac:58:75:9b:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Feb 25 10:16:00 2021 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Burger CA - 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                54:96:39:DC:94:0A:8F:BC:EA:87:80:32:B4:25:30:B9:53:F8:BA:8D
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9C64E24D2CAAA8DD45EF99BA62277CEEE6005C663624514B8C770E2D075BB611
    SPKI SHA256: 579EF7B314FCCAEF45413ECF6A29A62C9ABAD584A6EE0810193A92E0B0468EED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Burger CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 720B82C455E0D416
- SHA-256: AC289198EC699628803F8843DD63C764E856B8274CF79EDB8ED8E99979697F95
- SPKI SHA-256: 939BCF1EDFCC74DB5F727A420F0A9F123766E0B07B80133DBD7DA24DBD2420F3
- Validity: 2018-05-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/cps_en_pds/CPS_Digidentity_v1.2.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9045690
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8217805724833600534 (0x720b82c455e0d416)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: May 17 11:38:12 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                5C:81:C1:D1:7D:E7:22:86:92:C9:6A:43:56:C6:62:63:2A:4C:CB:39
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AC289198EC699628803F8843DD63C764E856B8274CF79EDB8ED8E99979697F95
    SPKI SHA256: 939BCF1EDFCC74DB5F727A420F0A9F123766E0B07B80133DBD7DA24DBD2420F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Burger CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 42F44DB83CA92E3532B9B7CF6BFBBA4071765877
- SHA-256: 21CADB7CD822EA13B496E25ABB8151C7FB00EFBB1EE458A3B4A4F3C16BC3C16F
- SPKI SHA-256: 939BCF1EDFCC74DB5F727A420F0A9F123766E0B07B80133DBD7DA24DBD2420F3
- Validity: 2019-04-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/terms/2019v2-CPS-PKIo.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.digidentity.eu/assets/files/terms/20200603-ETS043-ETSI411-1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:f4:4d:b8:3c:a9:2e:35:32:b9:b7:cf:6b:fb:ba:40:71:76:58:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Apr 17 09:37:30 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                5C:81:C1:D1:7D:E7:22:86:92:C9:6A:43:56:C6:62:63:2A:4C:CB:39
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 21CADB7CD822EA13B496E25ABB8151C7FB00EFBB1EE458A3B4A4F3C16BC3C16F
    SPKI SHA256: 939BCF1EDFCC74DB5F727A420F0A9F123766E0B07B80133DBD7DA24DBD2420F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 4C202F4CB11A53B4E82CE1B888F63EABC21B988F
- SHA-256: 533FE97EB45FCED24049E41EFE9DB254A5DD9D90DFD53C9512C6207EDB21D82C
- SPKI SHA-256: 32328159F2149E8E73A4765CA28C7FCD1A40119EC0005C2AC2D2D3E750612FE6
- Validity: 2019-04-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.digidentity.eu/api/media/file/2025-v1_CPS_PKIoverheid_(sealed).pdf
- CP/CPS same as parent: false
- Audit URLs: https://attestic.eu/wp-content/uploads/2026/01/CT-004-Digidentity-Certificate-2026-01-ETSI-319-411-1_v1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.digidentity.com/Digidentity-BV-PKIoverheid-Organisatie-Persoon-CA-G3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:20:2f:4c:b1:1a:53:b4:e8:2c:e1:b8:88:f6:3e:ab:c2:1b:98:8f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Apr 17 08:42:04 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                64:6D:5D:E3:A8:4C:A5:36:EE:26:36:2F:F5:57:54:4F:B8:52:7D:FF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 533FE97EB45FCED24049E41EFE9DB254A5DD9D90DFD53C9512C6207EDB21D82C
    SPKI SHA256: 32328159F2149E8E73A4765CA28C7FCD1A40119EC0005C2AC2D2D3E750612FE6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 329CAB52A80A2E3F
- SHA-256: DE83E3FC245F6B048931E1C8134EAACA96FAA7B1EF1D1395F3A62CE014B05182
- SPKI SHA-256: 32328159F2149E8E73A4765CA28C7FCD1A40119EC0005C2AC2D2D3E750612FE6
- Validity: 2018-05-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/cps_en_pds/CPS_Digidentity_v1.2.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9045690
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3646978169758166591 (0x329cab52a80a2e3f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: May 17 11:24:19 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                64:6D:5D:E3:A8:4C:A5:36:EE:26:36:2F:F5:57:54:4F:B8:52:7D:FF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DE83E3FC245F6B048931E1C8134EAACA96FAA7B1EF1D1395F3A62CE014B05182
    SPKI SHA256: 32328159F2149E8E73A4765CA28C7FCD1A40119EC0005C2AC2D2D3E750612FE6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 786C7C59FC7CA0C0
- SHA-256: 705610723C9613F6413181CADF73D51071BD761FDA491423E1ABD001501B64F3
- SPKI SHA-256: CE6E1EB8D0BE2625BEE1BCB7C4322FAE3340FB8ED54596F7327169CBEC551381
- Validity: 2018-05-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/cps_en_pds/2020-v3-CPS-PKIo.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9198662
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8677447307966062784 (0x786c7c59fc7ca0c0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: May 17 10:10:58 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                14:DA:48:49:70:51:B4:34:12:78:E6:8A:C0:15:7B:D8:1A:F7:1F:EA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 705610723C9613F6413181CADF73D51071BD761FDA491423E1ABD001501B64F3
    SPKI SHA256: CE6E1EB8D0BE2625BEE1BCB7C4322FAE3340FB8ED54596F7327169CBEC551381
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 555A3FF3ACDDB72382798A0C3C34E024F3482E48
- SHA-256: C7422DE21CEBC92ECAE6BE9DCD7E711EE650D30AED711FBB0DF6B2C784B6C4FB
- SPKI SHA-256: CE6E1EB8D0BE2625BEE1BCB7C4322FAE3340FB8ED54596F7327169CBEC551381
- Validity: 2019-04-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/cps_en_pds/2020-v3-CPS-PKIo.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9198662
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:5a:3f:f3:ac:dd:b7:23:82:79:8a:0c:3c:34:e0:24:f3:48:2e:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Apr 17 08:24:00 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                14:DA:48:49:70:51:B4:34:12:78:E6:8A:C0:15:7B:D8:1A:F7:1F:EA
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C7422DE21CEBC92ECAE6BE9DCD7E711EE650D30AED711FBB0DF6B2C784B6C4FB
    SPKI SHA256: CE6E1EB8D0BE2625BEE1BCB7C4322FAE3340FB8ED54596F7327169CBEC551381
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Organisatie Services CA - 2021

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Services CA - 2021
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 27909EB5DB69F40C220006F5663B6B93442FC915
- SHA-256: 827A6B205D2E73FF379286DD0B2DED5AEC7239EFE6BC8CACB03ABCCD84B95750
- SPKI SHA-256: 5E4CF2BE38345847FC3163D818AE5D53F706626DF38FAAC75D2DAAE09405B7FD
- Validity: 2021-02-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.digidentity.eu/api/media/file/2025-v1_CPS_PKIoverheid_(sealed).pdf
- CP/CPS same as parent: false
- Audit URLs: https://attestic.eu/wp-content/uploads/2026/01/CT-004-Digidentity-Certificate-2026-01-ETSI-319-411-1_v1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid-g3.digidentity-pki.com/Digidentity-BV-PKIoverheid-Organisatie-Services-CA-2021.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:90:9e:b5:db:69:f4:0c:22:00:06:f5:66:3b:6b:93:44:2f:c9:15
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Feb 25 09:49:32 2021 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Organisatie Services CA - 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
            X509v3 Subject Key Identifier:
                5A:CC:87:40:5D:AC:50:6E:8E:EA:A4:38:F7:A5:B3:9F:43:2C:C1:21
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.5
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 827A6B205D2E73FF379286DD0B2DED5AEC7239EFE6BC8CACB03ABCCD84B95750
    SPKI SHA256: 5E4CF2BE38345847FC3163D818AE5D53F706626DF38FAAC75D2DAAE09405B7FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity BV PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity BV PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 18FA39F559733720
- SHA-256: E0C27ACCB9AE78605B61E7826C021D91CCD2F769A58C4BD6DA54600B99E35438
- SPKI SHA-256: B7D82FAABA1E235254DB205F1A745F8AC86AF8D4B82A745F7F7A53FA1B86AA6E
- Validity: 2018-05-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/cps_en_pds/CPS_Digidentity_v1.2.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8970852
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1799814727018428192 (0x18fa39f559733720)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: May 17 09:49:53 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity BV PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                FD:19:7D:4C:38:1B:DD:C9:6D:0A:FD:C6:F3:C7:42:16:87:89:08:64
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E0C27ACCB9AE78605B61E7826C021D91CCD2F769A58C4BD6DA54600B99E35438
    SPKI SHA256: B7D82FAABA1E235254DB205F1A745F8AC86AF8D4B82A745F7F7A53FA1B86AA6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Digidentity Organisatie CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 013135AF
- SHA-256: 5294C86E349E6A3390EA5BD2D814907D831666EE61C57D9170D609A16FD356F3
- SPKI SHA-256: 43F37AD2F49A6951682D3C917EA74B94910F75471966FB4D54C1852116A78AB7
- Validity: 2011-04-06 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/terms/2019v2-CPS-PKIo.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.digidentity.eu/assets/files/terms/20200123-ETS043-411-1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002223 (0x13135af)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Apr  6 08:52:48 2011 GMT
            Not After : Mar 23 09:49:33 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                8F:5D:E9:0C:81:51:6E:9A:80:D2:88:D9:DB:B3:C7:DB:F9:08:FA:EB
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5294C86E349E6A3390EA5BD2D814907D831666EE61C57D9170D609A16FD356F3
    SPKI SHA256: 43F37AD2F49A6951682D3C917EA74B94910F75471966FB4D54C1852116A78AB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Digidentity PKIoverheid Burger CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 48CC1BDE9EDD4A50
- SHA-256: D56024F0C5D9237D7E0B2385067D8EF88EDDAE8EC199969F5CAA2CCC2969D982
- SPKI SHA-256: 05A1BC47ADEFD00062056FF6DF2C0D20D05752426582064DEEAEF75596FA7F2E
- Validity: 2018-03-22 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5245598308941777488 (0x48cc1bde9edd4a50)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Mar 22 10:16:29 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity PKIoverheid Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                D6:E3:A5:18:DE:5A:48:89:4E:BD:38:84:FA:9A:91:75:DD:55:24:21
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D56024F0C5D9237D7E0B2385067D8EF88EDDAE8EC199969F5CAA2CCC2969D982
    SPKI SHA256: 05A1BC47ADEFD00062056FF6DF2C0D20D05752426582064DEEAEF75596FA7F2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 5C923B50B4BAC6FF
- SHA-256: 41FD953685693CE67D0D23CC91CA179261D6B9948B21D3BBE5F7ADFBE53982DE
- SPKI SHA-256: 2A82FEB4FA4CE562689C7CDEDA962D4239EBD8DE3D1B05B3CD10AE538B3FDD2E
- Validity: 2018-03-22 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6670459215904687871 (0x5c923b50b4bac6ff)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Mar 22 10:06:27 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                69:18:9C:60:39:2C:9C:94:E5:F7:6B:FE:85:5B:40:B4:6C:65:2F:CD
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 41FD953685693CE67D0D23CC91CA179261D6B9948B21D3BBE5F7ADFBE53982DE
    SPKI SHA256: 2A82FEB4FA4CE562689C7CDEDA962D4239EBD8DE3D1B05B3CD10AE538B3FDD2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Digidentity PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 43BD389D3AEAC556
- SHA-256: 0F3320692B17A916CE54F7E4DA7BFE522FB31B1AC21E088776B37C07A34EE2A8
- SPKI SHA-256: F89E2D44A2FAEAC00051939F990060A94A0B12782BDD82FA3C7BDAADE0FE2CFF
- Validity: 2018-03-22 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4881119819088971094 (0x43bd389d3aeac556)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Mar 22 09:53:45 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                1C:6C:42:B7:11:DB:0F:68:15:1F:EA:C6:B9:AC:37:EE:CA:68:9F:8A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F3320692B17A916CE54F7E4DA7BFE522FB31B1AC21E088776B37C07A34EE2A8
    SPKI SHA256: F89E2D44A2FAEAC00051939F990060A94A0B12782BDD82FA3C7BDAADE0FE2CFF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Digidentity PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=Digidentity B.V., organizationIdentifier=NTRNL-27322631, commonName=Digidentity PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 78D60F883CCE32D4
- SHA-256: 4F304D8366FF9091EDD76D533BED55928E73B7AAAD52E35B86E762A77F04694E
- SPKI SHA-256: BCC6F04555BDCE42650A8214C14FC410D81F8FF5E596EF4403253CD7BB07E9D5
- Validity: 2018-03-22 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8707164007377547988 (0x78d60f883cce32d4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Mar 22 09:36:37 2018 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Digidentity B.V., organizationIdentifier = NTRNL-27322631, CN = Digidentity PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                E3:9A:2C:18:DB:1C:F1:BA:A6:CB:A7:A2:20:36:75:A1:0C:2A:EA:5F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4F304D8366FF9091EDD76D533BED55928E73B7AAAD52E35B86E762A77F04694E
    SPKI SHA256: BCC6F04555BDCE42650A8214C14FC410D81F8FF5E596EF4403253CD7BB07E9D5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Digidentity PKIoverheid Server CA 2020

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity PKIoverheid Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Serial: 1070E8640DC2957E4226EE4629DBD75199FE1EBE
- SHA-256: 522DE8097F16E76060B09D438B970B733560B1A7FA33767CB6BC41ABFB98AB3F
- SPKI SHA-256: 0E798BCC7667FA92DA40A67D73A95847904EAA164C7B2E3AF541794F58677B69
- Validity: 2020-07-28 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.digidentity.eu/assets/files/terms/2020-v1-CPS-PKIo.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.digidentity.eu/assets/files/terms/20200123-ETS043-411-1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:70:e8:64:0d:c2:95:7e:42:26:ee:46:29:db:d7:51:99:fe:1e:be
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Validity
            Not Before: Jul 28 12:19:57 2020 GMT
            Not After : Dec  5 00:00:00 2022 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity PKIoverheid Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomeinServerCA2020.cer
                OCSP - URI:http://domserver2020ocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                80:89:13:10:A0:2C:F7:FD:E6:4B:24:9B:D6:FB:0E:19:9E:CD:45:13
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 522DE8097F16E76060B09D438B970B733560B1A7FA33767CB6BC41ABFB98AB3F
    SPKI SHA256: 0E798BCC7667FA92DA40A67D73A95847904EAA164C7B2E3AF541794F58677B69
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomeinServerCA2020.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Digidentity PKIoverheid Server CA 2020

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity PKIoverheid Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Serial: 13A8CBC9B35CE15B3A98EC0FBF87B3380E06B6AF
- SHA-256: 37610BF756CA4C3CFA18696C4C149738E644CA9F676387EC50167365D6A45CCA
- SPKI SHA-256: 0E798BCC7667FA92DA40A67D73A95847904EAA164C7B2E3AF541794F58677B69
- Validity: 2020-07-29 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://assets.ctfassets.net/f8kgzjsvnt2r/2QsrWnpw0hV3Cl1coV359N/45a1a9732b8ef32bfcf039066ba9e010/2022-v1_CPS_PKIoverheid__signed_DDY_.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/digide-0047403032-000/ecertificate_-_ets_043.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:a8:cb:c9:b3:5c:e1:5b:3a:98:ec:0f:bf:87:b3:38:0e:06:b6:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Validity
            Not Before: Jul 29 18:34:42 2020 GMT
            Not After : Dec  5 00:00:00 2022 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity PKIoverheid Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomeinServerCA2020.cer
                OCSP - URI:http://domserver2020ocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                80:89:13:10:A0:2C:F7:FD:E6:4B:24:9B:D6:FB:0E:19:9E:CD:45:13
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 37610BF756CA4C3CFA18696C4C149738E644CA9F676387EC50167365D6A45CCA
    SPKI SHA256: 0E798BCC7667FA92DA40A67D73A95847904EAA164C7B2E3AF541794F58677B69
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomeinServerCA2020.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Digidentity Services CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Services CA - G2
- Issuer: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Organisatie CA - G2
- Serial: 0C
- SHA-256: 52001BF6C2DCF9C5AF2A99063FCB172814FB21B2E67E491FC520F07A7068D161
- SPKI SHA-256: 9A15D52356E403F239BADE777A6F57621C50F85CB0504F0AB1150C1F0EE8A09D
- Validity: 2011-05-03 to 2020-03-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 12 (0xc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Digidentity B.V., CN = Digidentity Organisatie CA - G2
        Validity
            Not Before: May  3 16:50:10 2011 GMT
            Not After : Mar 20 16:00:00 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9B:63:85:4F:B1:09:55:11:6A:1A:E7:3E:1E:1D:00:49:DB:96:F3:CD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 52001BF6C2DCF9C5AF2A99063FCB172814FB21B2E67E491FC520F07A7068D161
    SPKI SHA256: 9A15D52356E403F239BADE777A6F57621C50F85CB0504F0AB1150C1F0EE8A09D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### Digidentity Services CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Services CA - G2
- Issuer: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Organisatie CA - G2
- Serial: 0E
- SHA-256: 11B16B6EB1CD1B878A35218F6CFBCEE56D7F34D24A7642BBB006ED0BA8AE7880
- SPKI SHA-256: 9A15D52356E403F239BADE777A6F57621C50F85CB0504F0AB1150C1F0EE8A09D
- Validity: 2011-09-27 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://pki.digidentity.eu/L4/organisatie/latestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 14 (0xe)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Digidentity B.V., CN = Digidentity Organisatie CA - G2
        Validity
            Not Before: Sep 27 16:13:37 2011 GMT
            Not After : Mar 23 09:49:33 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity Services CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9B:63:85:4F:B1:09:55:11:6A:1A:E7:3E:1E:1D:00:49:DB:96:F3:CD
            X509v3 Authority Key Identifier:
                8F:5D:E9:0C:81:51:6E:9A:80:D2:88:D9:DB:B3:C7:DB:F9:08:FA:EB
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.digidentity.eu/L4/organisatie/latestCRL.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11B16B6EB1CD1B878A35218F6CFBCEE56D7F34D24A7642BBB006ED0BA8AE7880
    SPKI SHA256: 9A15D52356E403F239BADE777A6F57621C50F85CB0504F0AB1150C1F0EE8A09D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.digidentity.eu/L4/organisatie/latestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Digidentity SSCD CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity SSCD CA - G2
- Issuer: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Burger CA - G2
- Serial: 0D
- SHA-256: EC26D577EAF76884992C7F8839AB737294635CA552F9F9696E0137AFB4DF83D8
- SPKI SHA-256: AA92AC85E418AFC331B0D28F1A69A131862878C866871C6E54EB9367ED7207D4
- Validity: 2011-09-27 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://pki.digidentity.eu/L4/burger/latestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 13 (0xd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Digidentity B.V., CN = Digidentity Burger CA - G2
        Validity
            Not Before: Sep 27 15:38:22 2011 GMT
            Not After : Mar 23 10:29:46 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity SSCD CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9C:03:40:F1:0E:9E:0C:EE:84:E7:AD:C9:08:04:E7:9C:3C:B4:A3:A6
            X509v3 Authority Key Identifier:
                0F:12:1F:4D:F9:C4:E5:52:24:D0:E2:14:AB:BA:18:0E:1D:58:79:EE
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.digidentity.eu/L4/burger/latestCRL.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EC26D577EAF76884992C7F8839AB737294635CA552F9F9696E0137AFB4DF83D8
    SPKI SHA256: AA92AC85E418AFC331B0D28F1A69A131862878C866871C6E54EB9367ED7207D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.digidentity.eu/L4/burger/latestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Digidentity SSCD CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity SSCD CA - G2
- Issuer: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Burger CA - G2
- Serial: 0C
- SHA-256: A7FFAD289ED36FBBA729621207504A8055614A5551AE2D580870326985B2EF9D
- SPKI SHA-256: AA92AC85E418AFC331B0D28F1A69A131862878C866871C6E54EB9367ED7207D4
- Validity: 2011-05-03 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 12 (0xc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Digidentity B.V., CN = Digidentity Burger CA - G2
        Validity
            Not Before: May  3 16:21:25 2011 GMT
            Not After : Mar 23 10:29:46 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = Digidentity SSCD CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9C:03:40:F1:0E:9E:0C:EE:84:E7:AD:C9:08:04:E7:9C:3C:B4:A3:A6
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A7FFAD289ED36FBBA729621207504A8055614A5551AE2D580870326985B2EF9D
    SPKI SHA256: AA92AC85E418AFC331B0D28F1A69A131862878C866871C6E54EB9367ED7207D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### DigiNotar PKIoverheid CA Organisatie - G2

- Subject: countryName=NL, organizationName=DigiNotar B.V., commonName=DigiNotar PKIoverheid CA Organisatie - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 013134BF
- SHA-256: B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
- SPKI SHA-256: 7E7058EA35AD4359654159973F560187F16D19C514B939C5055672D1D2A518AC
- Validity: 2010-05-12 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20001983 (0x13134bf)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: May 12 08:51:38 2010 GMT
            Not After : Mar 23 09:50:04 2020 GMT
        Subject: C = NL, O = DigiNotar B.V., CN = DigiNotar PKIoverheid CA Organisatie - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.diginotar.nl/cps/pkioverheid
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                BC:5D:94:3B:D9:AB:7B:03:25:73:61:C2:DB:2D:EE:FC:AB:8F:65:A1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
    SPKI SHA256: 7E7058EA35AD4359654159973F560187F16D19C514B939C5055672D1D2A518AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### ESG Burger CA - G2

- Subject: countryName=NL, organizationName=ESG de Electronische Signatuur B.V., commonName=ESG Burger CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2
- Serial: 013139E7
- SHA-256: 7E6479DDDCF6622546BB72F08F68D245D8854206EDD92F8E6CC4471A6A3762BC
- SPKI SHA-256: 6EDF8D7C8455B2349AB6C0D223FADD386A6F009EF0B935B6B823006BED1183CD
- Validity: 2012-12-19 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: ESG de Electronische Signatuur B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.de-electronische-signatuur.nl/content/bestanden/pdf/cps-7.7-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9073165
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003303 (0x13139e7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G2
        Validity
            Not Before: Dec 19 10:56:57 2012 GMT
            Not After : Mar 23 10:55:09 2020 GMT
        Subject: C = NL, O = ESG de Electronische Signatuur B.V., CN = ESG Burger CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.de-electronische-signatuur.nl
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-15
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:91:A5:0D:DD:1D:A0:D1:2A:68:A7:1B:8D:DB:48:9A:AA:34:A9:7F:96
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                38:33:1D:F1:B5:37:F8:12:4F:AC:E9:2C:D2:32:7C:CF:D7:C2:53:A0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7E6479DDDCF6622546BB72F08F68D245D8854206EDD92F8E6CC4471A6A3762BC
    SPKI SHA256: 6EDF8D7C8455B2349AB6C0D223FADD386A6F009EF0B935B6B823006BED1183CD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_directory_name_present: 
- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### ESG CA - G2

- Subject: countryName=NL, organizationName=ESG de electronische signatuur BV, commonName=ESG CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 01313311
- SHA-256: 5194F31A7948D1649544DEE901D08F3CA3420C3A6837144352F06E4864193893
- SPKI SHA-256: 06B7BB83F117627A81D7527681CB4CD70DB0F1B6A6F1128975FCE8DF4ACFCB0D
- Validity: 2009-07-14 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.de-electronische-signatuur.nl/nl/certification-practice-statement
- CP/CPS same as parent: false
- Audit URLs: https://www.de-electronische-signatuur.nl/content/bestanden/documenten/ETS047-2.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20001553 (0x1313311)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Jul 14 08:36:40 2009 GMT
            Not After : Mar 23 09:35:09 2020 GMT
        Subject: C = NL, O = ESG de electronische signatuur BV, CN = ESG CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.csp4.eu
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                61:D7:90:DE:8A:13:82:6C:E4:3E:D6:9E:15:9F:38:0D:4A:27:D0:AD
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5194F31A7948D1649544DEE901D08F3CA3420C3A6837144352F06E4864193893
    SPKI SHA256: 06B7BB83F117627A81D7527681CB4CD70DB0F1B6A6F1128975FCE8DF4ACFCB0D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### ESG Organisatie CA - G2

- Subject: countryName=NL, organizationName=ESG de Electronische Signatuur B.V., commonName=ESG Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 013138C5
- SHA-256: 83502D199E19A7B82B5DC409F1E1C329BCAE2CF250F67D77AE774B6DB347CB97
- SPKI SHA-256: 42C4573BA9C3562B5974CC2841694223312B9145CDC9C718477B6F04F00ED665
- Validity: 2012-12-19 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Digidentity B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.de-electronische-signatuur.nl/content/bestanden/pdf/cps-7.7-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9073165
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003013 (0x13138c5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Dec 19 10:14:05 2012 GMT
            Not After : Mar 23 10:10:36 2020 GMT
        Subject: C = NL, O = ESG de Electronische Signatuur B.V., CN = ESG Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.de-electronische-signatuur.nl
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-14
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                BA:2C:77:0B:08:F7:0D:74:1D:2F:DC:5D:80:A3:97:41:EC:A8:27:A8
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 83502D199E19A7B82B5DC409F1E1C329BCAE2CF250F67D77AE774B6DB347CB97
    SPKI SHA256: 42C4573BA9C3562B5974CC2841694223312B9145CDC9C718477B6F04F00ED665
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_directory_name_present: 
- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### ESG Persoonlijk CA - G2

- Subject: countryName=NL, organizationName=ESG de electronische signatuur BV, commonName=ESG Persoonlijk CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2
- Serial: 013137DF
- SHA-256: D2075EE0CB6C4152F74946DE8926C8ACFA1958198DD9A1874F50F23E9F76EF5F
- SPKI SHA-256: 70A420DAD62A8D2CA208E655EAC1C7E29673BE29F6F6DC256A96EDA5748C3FCD
- Validity: 2010-02-16 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.de-electronische-signatuur.nl/nl/certification-practice-statement
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002783 (0x13137df)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G2
        Validity
            Not Before: Feb 16 09:23:07 2010 GMT
            Not After : Mar 23 09:20:45 2020 GMT
        Subject: C = NL, O = ESG de electronische signatuur BV, CN = ESG Persoonlijk CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.csp4.eu
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:91:A5:0D:DD:1D:A0:D1:2A:68:A7:1B:8D:DB:48:9A:AA:34:A9:7F:96
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                02:94:6C:FA:72:6E:53:B8:1E:C4:28:11:83:75:25:4C:97:79:FE:BD
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D2075EE0CB6C4152F74946DE8926C8ACFA1958198DD9A1874F50F23E9F76EF5F
    SPKI SHA256: 70A420DAD62A8D2CA208E655EAC1C7E29673BE29F6F6DC256A96EDA5748C3FCD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### ESG Persoonlijk CA – G2

- Subject: countryName=NL, organizationName=ESG de electronische signatuur BV, commonName=ESG Persoonlijk CA – G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2
- Serial: 0131377B
- SHA-256: AB0B69E62FF71A29CB17D3E50E196C45AE3B6582FBD2B315F4DCBCF41BCF4E38
- SPKI SHA-256: DDBA8ECCE68F844C3911C5EB4E962CF401D8A49C6F9D1308A322642BDB3C12FF
- Validity: 2009-12-16 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.de-electronische-signatuur.nl/nl/certification-practice-statement
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002683 (0x131377b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G2
        Validity
            Not Before: Dec 16 10:13:36 2009 GMT
            Not After : Mar 23 10:12:03 2020 GMT
        Subject: C = NL, O = ESG de electronische signatuur BV, CN = ESG Persoonlijk CA \E2\80\93 G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.csp4.eu
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:91:A5:0D:DD:1D:A0:D1:2A:68:A7:1B:8D:DB:48:9A:AA:34:A9:7F:96
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                96:5A:69:BF:A2:DE:A2:B2:9E:3E:03:5D:D8:7C:A4:7E:0B:A6:90:F7
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB0B69E62FF71A29CB17D3E50E196C45AE3B6582FBD2B315F4DCBCF41BCF4E38
    SPKI SHA256: DDBA8ECCE68F844C3911C5EB4E962CF401D8A49C6F9D1308A322642BDB3C12FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Getronics CSP Justitie CA - G2

- Subject: countryName=NL, organizationName=Getronics Nederland BV, commonName=Getronics CSP Justitie CA - G2
- Issuer: countryName=NL, organizationName=Getronics Nederland BV, commonName=Getronics CSP Organisatie CA - G2
- Serial: 7D4F89A5B71863EBF8E860D2777197D7
- SHA-256: 3D04DAC79454FCF3F6D41F3FEEB282A1C1CC9BCE890211287B4F68DEED8B2DA3
- SPKI SHA-256: F773DC6720654CB7E962C306B1BDD2D0D8520F1439E4A4415593C0CAFA642EDE
- Validity: 2010-05-18 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://cert.managedpki.com/pkioverheid/crl/GetronicsCSPOrganisatieCAG2/LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:4f:89:a5:b7:18:63:eb:f8:e8:60:d2:77:71:97:d7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Getronics Nederland BV, CN = Getronics CSP Organisatie CA - G2
        Validity
            Not Before: May 18 00:00:00 2010 GMT
            Not After : Mar 22 23:59:59 2020 GMT
        Subject: C = NL, O = Getronics Nederland BV, CN = Getronics CSP Justitie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.pki.getronics.nl/pkioverheid/cps
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cert.managedpki.com/pkioverheid/crl/GetronicsCSPOrganisatieCAG2/LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name:
                DirName:/CN=Jus4096-1
            X509v3 Subject Key Identifier:
                76:E2:32:36:16:03:70:29:03:17:23:1E:B5:C9:48:EC:EB:10:7F:6C
            X509v3 Authority Key Identifier:
                38:B2:85:E6:AD:F8:A6:D0:41:58:5B:78:6F:DC:D5:B8:44:76:C5:7B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3D04DAC79454FCF3F6D41F3FEEB282A1C1CC9BCE890211287B4F68DEED8B2DA3
    SPKI SHA256: F773DC6720654CB7E962C306B1BDD2D0D8520F1439E4A4415593C0CAFA642EDE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://cert.managedpki.com/pkioverheid/crl/GetronicsCSPOrganisatieCAG2/LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Getronics CSP Organisatie CA - G2

- Subject: countryName=NL, organizationName=Getronics Nederland BV, commonName=Getronics CSP Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 013133F7
- SHA-256: 53DCE946B84A27AB322EF9319EF0411BB9550419F97B5DD3249FCA7D0A7B434C
- SPKI SHA-256: 608AE931A8C5187774ACDC1482249A26F3B043C3DA76286F928E23359CB2A2E1
- Validity: 2009-12-16 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20001783 (0x13133f7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Dec 16 09:30:35 2009 GMT
            Not After : Mar 23 09:27:47 2020 GMT
        Subject: C = NL, O = Getronics Nederland BV, CN = Getronics CSP Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.pki.getronics.nl/pkioverheid/CPS
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                38:B2:85:E6:AD:F8:A6:D0:41:58:5B:78:6F:DC:D5:B8:44:76:C5:7B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 53DCE946B84A27AB322EF9319EF0411BB9550419F97B5DD3249FCA7D0A7B434C
    SPKI SHA256: 608AE931A8C5187774ACDC1482249A26F3B043C3DA76286F928E23359CB2A2E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### KPN BV PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 0F08387DD5DF4B99
- SHA-256: A9B5698C5263BEFF3D60720DC1844CB95D16F06E04268BCE3BE4D60282B01EF9
- SPKI SHA-256: F335E4D71F0BD5CCBB81EF14C155FF2FCDE33EADEE2E63159DA5D7DFCB402B25
- Validity: 2016-12-08 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.1.html, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.13.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ets_029.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.managedpki.com/KPNBVPKIoverheidOrganisatiePersoonCAG3/LatestCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1083177823492852633 (0xf08387dd5df4b99)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Dec  8 10:32:11 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., organizationIdentifier = NTRNL-27124701, CN = KPN BV PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                77:17:48:EE:1B:7D:6E:7C:DA:5C:DC:0C:98:30:18:E6:0D:76:D3:30
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A9B5698C5263BEFF3D60720DC1844CB95D16F06E04268BCE3BE4D60282B01EF9
    SPKI SHA256: F335E4D71F0BD5CCBB81EF14C155FF2FCDE33EADEE2E63159DA5D7DFCB402B25
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### KPN BV PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 61C52F585598525C
- SHA-256: 7E082BBC56976B159D4696540A96B60148614BA9B5E29B2035F789BECFBF0657
- SPKI SHA-256: AD6D469E926687693D17AB8D2061439B6ECC98BD23E0ED42C326F2C859FE4D7B
- Validity: 2016-12-08 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.4_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bug1434881.bmoattachments.org/attachment.cgi?id=9173298
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7045089248530682460 (0x61c52f585598525c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Dec  8 10:13:55 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., organizationIdentifier = NTRNL-27124701, CN = KPN BV PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                C3:9A:A6:7B:5E:74:2B:82:B6:C6:72:FD:74:4E:85:D2:97:CD:FD:18
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7E082BBC56976B159D4696540A96B60148614BA9B5E29B2035F789BECFBF0657
    SPKI SHA256: AD6D469E926687693D17AB8D2061439B6ECC98BD23E0ED42C326F2C859FE4D7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN BV PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 7B7485B9F0514A5521E52D391A1AAEDB936D8F8C
- SHA-256: 5679A431E79D4EB9EE967C60D8703C7C78F443F71DB97157E43059DE42D850DF
- SPKI SHA-256: AD6D469E926687693D17AB8D2061439B6ECC98BD23E0ED42C326F2C859FE4D7B
- Validity: 2019-04-16 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.4_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bug1434881.bmoattachments.org/attachment.cgi?id=9173298
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:74:85:b9:f0:51:4a:55:21:e5:2d:39:1a:1a:ae:db:93:6d:8f:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Apr 16 08:40:16 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., organizationIdentifier = NTRNL-27124701, CN = KPN BV PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                C3:9A:A6:7B:5E:74:2B:82:B6:C6:72:FD:74:4E:85:D2:97:CD:FD:18
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5679A431E79D4EB9EE967C60D8703C7C78F443F71DB97157E43059DE42D850DF
    SPKI SHA256: AD6D469E926687693D17AB8D2061439B6ECC98BD23E0ED42C326F2C859FE4D7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN BV PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., organizationIdentifier=NTRNL-27124701, commonName=KPN BV PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 43F05CBC60CB61F1
- SHA-256: F22DB657A1A929841ABCAC52671A5CEE8A7D069586AF85CE16DE2B05DDA22252
- SPKI SHA-256: 4758E5D40C5FDF6AC587E6BD947B1CC1A51B53BB39D7F7CF5D6A8668BC9B4B2E
- Validity: 2016-12-08 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.13.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ets_029.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.managedpki.com/KPNBVPKIoverheidOrganisatieServicesCAG3/LatestCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4895514759099277809 (0x43f05cbc60cb61f1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Dec  8 09:50:10 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., organizationIdentifier = NTRNL-27124701, CN = KPN BV PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                14:00:B8:B3:6F:73:0D:C1:85:EA:26:16:2B:25:E2:91:08:15:BD:BB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F22DB657A1A929841ABCAC52671A5CEE8A7D069586AF85CE16DE2B05DDA22252
    SPKI SHA256: 4758E5D40C5FDF6AC587E6BD947B1CC1A51B53BB39D7F7CF5D6A8668BC9B4B2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN CM PKIoverheid EV CA

- Subject: countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN CM PKIoverheid EV CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Serial: 6A4596653CAD8B2E7C9F22CEB2AA6769
- SHA-256: 4B24C521C47600E83800A3FF0C2D58DC02C8177EF7DA697C5A80C1D4867A66DD
- SPKI SHA-256: 2D32B37D55F972CA15102B184A82A0583F1F0B1BE9915FD0BE7A739925C3EBB1
- Validity: 2015-10-21 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.1_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9090451
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:45:96:65:3c:ad:8b:2e:7c:9f:22:ce:b2:aa:67:69
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Validity
            Not Before: Oct 21 00:00:00 2015 GMT
            Not After : Dec  5 23:59:59 2022 GMT
        Subject: C = NL, O = KPN Corporate Market B.V., CN = KPN CM PKIoverheid EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: https://cps.pkioverheid.nl
            X509v3 Subject Key Identifier:
                2F:40:0C:09:68:E9:6B:B8:52:D7:FB:09:C4:09:DF:E1:4C:90:1B:5C
            X509v3 Authority Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            Authority Information Access:
                OCSP - URI:http://ocsp.pkioverheid.nl
                CA Issuers - URI:https://cert.pkioverheid.nl/EVIntermediairCA.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4B24C521C47600E83800A3FF0C2D58DC02C8177EF7DA697C5A80C1D4867A66DD
    SPKI SHA256: 2D32B37D55F972CA15102B184A82A0583F1F0B1BE9915FD0BE7A739925C3EBB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: http://ocsp.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/EVIntermediairCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KPN Corporate Market CSP Justitie CA - G2

- Subject: countryName=NL, organizationName=KPN Corporate Market BV, commonName=KPN Corporate Market CSP Justitie CA - G2
- Issuer: countryName=NL, organizationName=KPN Corporate Market BV, commonName=KPN Corporate Market CSP Organisatie CA - G2
- Serial: 71F9A57C025977E7239AEC54617DBE0B
- SHA-256: E3BFE8F042B2C44406FB54ACB85ADD81E88F9366884B7B42947968F86E7E9A23
- SPKI SHA-256: 1C97DAF43DC5434841AF6DCA0CE8802E982206C05A2AAB03F873BF13B0B5EC00
- Validity: 2012-02-28 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://cert.managedpki.com/pkioverheid/crl/KPNCorporateMarketCSPOrganisatieCAG2/LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:f9:a5:7c:02:59:77:e7:23:9a:ec:54:61:7d:be:0b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = KPN Corporate Market BV, CN = KPN Corporate Market CSP Organisatie CA - G2
        Validity
            Not Before: Feb 28 00:00:00 2012 GMT
            Not After : Mar 22 23:59:59 2020 GMT
        Subject: C = NL, O = KPN Corporate Market BV, CN = KPN Corporate Market CSP Justitie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://certificaat.kpn.com/pkioverheid/cps
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://cert.managedpki.com/pkioverheid/crl/KPNCorporateMarketCSPOrganisatieCAG2/LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name:
                DirName:/CN=Jus4096-2
            X509v3 Subject Key Identifier:
                A2:AD:23:C1:56:E6:26:E1:C7:9E:A9:BC:EA:96:6C:C5:75:AE:CC:BD
            X509v3 Authority Key Identifier:
                26:D0:65:13:F1:EE:7A:6F:61:08:28:DE:4D:98:07:12:48:78:B4:EF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E3BFE8F042B2C44406FB54ACB85ADD81E88F9366884B7B42947968F86E7E9A23
    SPKI SHA256: 1C97DAF43DC5434841AF6DCA0CE8802E982206C05A2AAB03F873BF13B0B5EC00
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://cert.managedpki.com/pkioverheid/crl/KPNCorporateMarketCSPOrganisatieCAG2/LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### KPN Corporate Market CSP Organisatie CA - G2

- Subject: countryName=NL, organizationName=KPN Corporate Market BV, commonName=KPN Corporate Market CSP Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 01313717
- SHA-256: CB37E05DBC455A09481F3EF56AAC7E887676A4B61346394E6EE6A9447EA8D6BD
- SPKI SHA-256: 2CD018FBC24F2061B50BFC0CBA411174F71AE6747535EF86626F824F7047C1BC
- Validity: 2012-02-08 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.1_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9090451
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002583 (0x1313717)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Feb  8 10:56:39 2012 GMT
            Not After : Mar 23 10:53:05 2020 GMT
        Subject: C = NL, O = KPN Corporate Market BV, CN = KPN Corporate Market CSP Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://certificaat.kpn.com/pkioverheid/cps
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-11
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                26:D0:65:13:F1:EE:7A:6F:61:08:28:DE:4D:98:07:12:48:78:B4:EF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CB37E05DBC455A09481F3EF56AAC7E887676A4B61346394E6EE6A9447EA8D6BD
    SPKI SHA256: 2CD018FBC24F2061B50BFC0CBA411174F71AE6747535EF86626F824F7047C1BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### KPN Corporate Market CSP Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN Corporate Market CSP Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 01313922
- SHA-256: EC4B416C4128A56481B886B3299DD1F8C3D56490501FD3EC1A12541ABD28C7D7
- SPKI SHA-256: 23A7F9224BF92940ECCC116C57831886A547742054D9E0A62C864401B4EAE409
- Validity: 2013-11-14 to 2028-11-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003106 (0x1313922)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Nov 14 14:07:03 2013 GMT
            Not After : Nov 11 23:00:00 2028 GMT
        Subject: C = NL, O = KPN Corporate Market B.V., CN = KPN Corporate Market CSP Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://certificaat.kpn.com/pkioverheid/cps
            Authority Information Access:
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-16
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                F0:E7:F9:E0:46:C8:F2:10:DC:F0:09:21:F2:37:BB:BB:64:42:5D:47
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EC4B416C4128A56481B886B3299DD1F8C3D56490501FD3EC1A12541ABD28C7D7
    SPKI SHA256: 23A7F9224BF92940ECCC116C57831886A547742054D9E0A62C864401B4EAE409
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_directory_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN PKIoverheid EV CA

- Subject: countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid EV CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Serial: 5408075533E037002E628FF2FE391DE4
- SHA-256: C7478EDF73101BA12EECDDF348C7747FFF789EFB401CC8DCADFAE09429543E54
- SPKI SHA-256: 4579A92665DBC4812133709F665B8C6BFF19DF5887B9092D2A69BACDF7CC186F
- Validity: 2015-03-05 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_EVSSL_v1.3.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8970536
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:08:07:55:33:e0:37:00:2e:62:8f:f2:fe:39:1d:e4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Validity
            Not Before: Mar  5 00:00:00 2015 GMT
            Not After : Dec  5 23:59:59 2022 GMT
        Subject: C = NL, O = KPN Corporate Market B.V., CN = KPN PKIoverheid EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: https://cps.pkioverheid.nl
            X509v3 Subject Key Identifier:
                BC:44:E7:36:C1:52:A1:36:6E:7C:4C:C4:3D:7C:80:83:C7:57:EB:53
            X509v3 Authority Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
            X509v3 Subject Alternative Name:
                DirName:/CN=PRIV-SA5-4K-1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            Authority Information Access:
                OCSP - URI:http://ocsp.pkioverheid.nl
                CA Issuers - URI:https://cert.pkioverheid.nl/EVIntermediairCA.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C7478EDF73101BA12EECDDF348C7747FFF789EFB401CC8DCADFAE09429543E54
    SPKI SHA256: 4579A92665DBC4812133709F665B8C6BFF19DF5887B9092D2A69BACDF7CC186F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: http://ocsp.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/EVIntermediairCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_directory_name_present: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KPN PKIoverheid EV CA

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid EV CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Serial: 0A32913335AD3DFF3F33B2E283258A4D
- SHA-256: 5DB1D22D706684F0719E8902FB86B346B3FC9E4D1A1F92283A488BC3D1A0484B
- SPKI SHA-256: 237B1E60F05CA932C20D15FBDF6C3156D05A08040ECCD6AC7782AA3BA6B49879
- Validity: 2016-03-03 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.4_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bug1434881.bmoattachments.org/attachment.cgi?id=9173298
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:32:91:33:35:ad:3d:ff:3f:33:b2:e2:83:25:8a:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Validity
            Not Before: Mar  3 00:00:00 2016 GMT
            Not After : Dec  5 23:59:59 2022 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: https://cps.pkioverheid.nl
            X509v3 Subject Key Identifier:
                80:03:85:B0:A7:63:92:DF:1C:7F:5F:28:F2:5D:9D:1C:EE:BB:4C:08
            X509v3 Authority Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            Authority Information Access:
                OCSP - URI:http://ocsp.pkioverheid.nl
                CA Issuers - URI:https://cert.pkioverheid.nl/EVIntermediairCA.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5DB1D22D706684F0719E8902FB86B346B3FC9E4D1A1F92283A488BC3D1A0484B
    SPKI SHA256: 237B1E60F05CA932C20D15FBDF6C3156D05A08040ECCD6AC7782AA3BA6B49879
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: http://ocsp.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/EVIntermediairCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KPN PKIoverheid Organisatie CA - G2

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 334EF816CD24A068
- SHA-256: 8F2566A8FCCF6AE8C358B0B8A6D8C7FF0AB16341636478C8BB544E9DD6AA6011
- SPKI SHA-256: 1E286657D44734E4CAB706CFE0498DFF2152833C5B85787F1C63C86F42FB0E17
- Validity: 2016-04-12 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.1_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9090451
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3697165120932454504 (0x334ef816cd24a068)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Apr 12 09:26:10 2016 GMT
            Not After : Mar 23 00:00:00 2020 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieCA-G2.cer
            X509v3 Subject Key Identifier:
                75:A3:4E:8F:1E:97:DD:6C:88:01:31:EF:72:21:C2:6E:60:94:7D:80
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F2566A8FCCF6AE8C358B0B8A6D8C7FF0AB16341636478C8BB544E9DD6AA6011
    SPKI SHA256: 1E286657D44734E4CAB706CFE0498DFF2152833C5B85787F1C63C86F42FB0E17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieCA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### KPN PKIoverheid Organisatie CA - G2

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 6440A045D644B27B
- SHA-256: 35DCF7EB97DC4A8ECB755056AAD032ED454F2AEC353F7EB381A4EBDEAF5FD60A
- SPKI SHA-256: 1E286657D44734E4CAB706CFE0498DFF2152833C5B85787F1C63C86F42FB0E17
- Validity: 2016-03-03 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7223950024110289531 (0x6440a045d644b27b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Mar  3 09:32:06 2016 GMT
            Not After : Mar 23 00:00:00 2020 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieCA-G2.cer
            X509v3 Subject Key Identifier:
                75:A3:4E:8F:1E:97:DD:6C:88:01:31:EF:72:21:C2:6E:60:94:7D:80
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 35DCF7EB97DC4A8ECB755056AAD032ED454F2AEC353F7EB381A4EBDEAF5FD60A
    SPKI SHA256: 1E286657D44734E4CAB706CFE0498DFF2152833C5B85787F1C63C86F42FB0E17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieCA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### KPN PKIoverheid Organisatie CA - G2

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 2D345C0C769B4475
- SHA-256: ADB25387D6C91927919DCEC5FABFB0A9253E7861C71CE6312D89E8679B58B1F0
- SPKI SHA-256: 1E286657D44734E4CAB706CFE0498DFF2152833C5B85787F1C63C86F42FB0E17
- Validity: 2016-04-08 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3257329639094961269 (0x2d345c0c769b4475)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Apr  8 15:38:27 2016 GMT
            Not After : Mar 23 00:00:00 2020 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieCA-G2.cer
            X509v3 Subject Key Identifier:
                75:A3:4E:8F:1E:97:DD:6C:88:01:31:EF:72:21:C2:6E:60:94:7D:80
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ADB25387D6C91927919DCEC5FABFB0A9253E7861C71CE6312D89E8679B58B1F0
    SPKI SHA256: 1E286657D44734E4CAB706CFE0498DFF2152833C5B85787F1C63C86F42FB0E17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieCA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### KPN PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 7F8DCEF53B9A951F
- SHA-256: E0FF93E9056C48EDDC6B68E94F315C3A2229E9CE24AF33634D34D5EF03233289
- SPKI SHA-256: 8B14576A640706412E9FA6007267DDBE083385E901E2F83EF33B69689D4F16BE
- Validity: 2015-11-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9191229967195346207 (0x7f8dcef53b9a951f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Nov 25 10:39:50 2015 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                48:9F:81:7C:95:FD:02:AA:6D:DC:A3:42:88:31:6A:F5:9D:82:A1:38
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E0FF93E9056C48EDDC6B68E94F315C3A2229E9CE24AF33634D34D5EF03233289
    SPKI SHA256: 8B14576A640706412E9FA6007267DDBE083385E901E2F83EF33B69689D4F16BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### KPN PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 01313AC3
- SHA-256: 3F785025BCCFACA4701A1734CE0F7B30CE4106942C8D92F41B70B067ED65D354
- SPKI SHA-256: CFAA38A9A21D70017F7180F922857E1C8C802CDC30841A10AA930AD4D8AB6D78
- Validity: 2015-03-12 to 2028-11-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.1_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9090451
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003523 (0x1313ac3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Mar 12 09:40:43 2015 GMT
            Not After : Nov 11 23:00:00 2028 GMT
        Subject: C = NL, O = KPN Corporate Market B.V., CN = KPN PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Alternative Name:
                DirName:/CN=PRIV-SA5-4K-2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                6F:1F:F9:16:E9:C3:38:4B:79:79:07:E6:F9:ED:78:F5:09:78:D0:15
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3F785025BCCFACA4701A1734CE0F7B30CE4106942C8D92F41B70B067ED65D354
    SPKI SHA256: CFAA38A9A21D70017F7180F922857E1C8C802CDC30841A10AA930AD4D8AB6D78
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### KPN PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 01313A5F
- SHA-256: 71B3ED8CEECCC0638CD2022B426E921766271DE62367C7CD852EC2F1E1111E76
- SPKI SHA-256: A133892AF3C0BCD15C61331D35D606FA9F2C0BDB2FA077F7492B9844D5BD6425
- Validity: 2015-03-12 to 2028-11-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003423 (0x1313a5f)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Mar 12 10:18:17 2015 GMT
            Not After : Nov 11 23:00:00 2028 GMT
        Subject: C = NL, O = KPN Corporate Market B.V., CN = KPN PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
            X509v3 Subject Alternative Name:
                DirName:/CN=PRIV-SA5-4K-3
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                AB:A0:A6:74:79:0C:AA:C3:75:15:AA:63:1F:36:B7:AE:30:A5:A3:F3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 71B3ED8CEECCC0638CD2022B426E921766271DE62367C7CD852EC2F1E1111E76
    SPKI SHA256: A133892AF3C0BCD15C61331D35D606FA9F2C0BDB2FA077F7492B9844D5BD6425
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_directory_name_present: 
- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 6B301C4D62FE8A3B
- SHA-256: 8865B02E14039167561322C8C1EC2E77C47CF7BEB731D2FE1CBBACBF72D1772C
- SPKI SHA-256: D879A7ECF2E06142D95040E5683A33BA18B50EE0F1630F01EE109E050E5348C1
- Validity: 2015-11-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7723704479639308859 (0x6b301c4d62fe8a3b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Nov 25 10:08:04 2015 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                84:7B:1B:12:E2:1E:C5:03:1E:59:60:FB:E2:4D:58:75:C5:CF:1B:3D
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8865B02E14039167561322C8C1EC2E77C47CF7BEB731D2FE1CBBACBF72D1772C
    SPKI SHA256: D879A7ECF2E06142D95040E5683A33BA18B50EE0F1630F01EE109E050E5348C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=KPN Corporate Market B.V., commonName=KPN PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 01313A60
- SHA-256: CE0250F2A9F18F68D5FF944A4C659F6692F73E0369CECC215F5F257E32259878
- SPKI SHA-256: 1268AFE63C0E5C661D1504EA6DC0AAB207A853A6BDA9E16AED703F8E29D977F2
- Validity: 2015-03-12 to 2028-11-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003424 (0x1313a60)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Mar 12 10:44:40 2015 GMT
            Not After : Nov 11 23:00:00 2028 GMT
        Subject: C = NL, O = KPN Corporate Market B.V., CN = KPN PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
            X509v3 Subject Alternative Name:
                DirName:/CN=PRIV-SA5-4K-4
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                5F:70:0A:66:FC:86:56:6A:09:79:EA:01:27:70:F1:2F:68:E0:DB:AD
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CE0250F2A9F18F68D5FF944A4C659F6692F73E0369CECC215F5F257E32259878
    SPKI SHA256: 1268AFE63C0E5C661D1504EA6DC0AAB207A853A6BDA9E16AED703F8E29D977F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 2D84D75A4EE032EF
- SHA-256: E956B8A156871F71D434CAC78EBD23D50EFD1AB90761CE436E79D03AED13664C
- SPKI SHA-256: E14B04ADC30EB4BF8A210FD197823CEC99AD5DDE09F348D023B2D67E7BE502F6
- Validity: 2015-11-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v4.24.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8746607
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3279983211502908143 (0x2d84d75a4ee032ef)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Nov 25 09:51:07 2015 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                D6:9C:07:CD:98:81:EF:CD:D8:37:31:B2:92:29:2F:6F:9E:DF:D5:0D
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E956B8A156871F71D434CAC78EBD23D50EFD1AB90761CE436E79D03AED13664C
    SPKI SHA256: E14B04ADC30EB4BF8A210FD197823CEC99AD5DDE09F348D023B2D67E7BE502F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KPN PKIoverheid Server CA 2020

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Serial: 7498A8335021985ADD2945B2D159D929733BDADD
- SHA-256: 592E1A2F0A34284B0E26FCB4FED22AF859848EEE8822ADB61B42DAB47A2FFDC2
- SPKI SHA-256: 61AA3E460CC89583615DCEB9721F48A4ACD244551288BD3512DF1CEAC3785CB5
- Validity: 2020-07-29 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/english/pkioverheid, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.9.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/pink_r-0047218133-000/ecertificate_-_ets_029.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.managedpki.com/KPNPKIoverheidServerCA2020/LatestCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:98:a8:33:50:21:98:5a:dd:29:45:b2:d1:59:d9:29:73:3b:da:dd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Validity
            Not Before: Jul 29 18:23:54 2020 GMT
            Not After : Dec  5 00:00:00 2022 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomeinServerCA2020.cer
                OCSP - URI:http://domserver2020ocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                08:4A:AA:BB:99:24:6F:BE:5B:07:F1:A5:8A:99:5B:2D:47:EF:B9:3C
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 592E1A2F0A34284B0E26FCB4FED22AF859848EEE8822ADB61B42DAB47A2FFDC2
    SPKI SHA256: 61AA3E460CC89583615DCEB9721F48A4ACD244551288BD3512DF1CEAC3785CB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomeinServerCA2020.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### KPN PKIoverheid Server CA 2020

- Subject: countryName=NL, organizationName=KPN B.V., commonName=KPN PKIoverheid Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Serial: 7AB130A2ADE85DE546DCE3E34CABC837B1F725D4
- SHA-256: 1B0E9C5765A4020508C7B015277B57CEF0EF217DB9F2BDBA0DA3641433D15960
- SPKI SHA-256: 61AA3E460CC89583615DCEB9721F48A4ACD244551288BD3512DF1CEAC3785CB5
- Validity: 2020-07-28 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: KPN B.V.
- CP/CPS: https://www.logius.nl/english/pkioverheid, https://certificaat.kpn.com/files/CPS/KPN_PKIoverheid_CPS_v5.4_English.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bug1434881.bmoattachments.org/attachment.cgi?id=9173298
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:b1:30:a2:ad:e8:5d:e5:46:dc:e3:e3:4c:ab:c8:37:b1:f7:25:d4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Validity
            Not Before: Jul 28 11:57:40 2020 GMT
            Not After : Dec  5 00:00:00 2022 GMT
        Subject: C = NL, O = KPN B.V., CN = KPN PKIoverheid Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomeinServerCA2020.cer
                OCSP - URI:http://domserver2020ocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                08:4A:AA:BB:99:24:6F:BE:5B:07:F1:A5:8A:99:5B:2D:47:EF:B9:3C
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1B0E9C5765A4020508C7B015277B57CEF0EF217DB9F2BDBA0DA3641433D15960
    SPKI SHA256: 61AA3E460CC89583615DCEB9721F48A4ACD244551288BD3512DF1CEAC3785CB5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomeinServerCA2020.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MachtigingOnline SSCD CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=MachtigingOnline SSCD CA - G2
- Issuer: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Organisatie CA - G2
- Serial: 0B
- SHA-256: 8FFEDAB0CC80A91C04C244AC2A79E0B80072E5563BCF36F0A99FF7EB0B89D793
- SPKI SHA-256: 60121B5005A86DEB10CC5DB397C86609CD954875987FA9625C55DA7034C76709
- Validity: 2011-05-03 to 2020-03-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 11 (0xb)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Digidentity B.V., CN = Digidentity Organisatie CA - G2
        Validity
            Not Before: May  3 16:37:40 2011 GMT
            Not After : Mar 20 16:00:00 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = MachtigingOnline SSCD CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C0:37:B7:FE:70:1C:D8:99:6C:51:BE:E7:64:73:AF:0B:33:AB:CC:E1
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8FFEDAB0CC80A91C04C244AC2A79E0B80072E5563BCF36F0A99FF7EB0B89D793
    SPKI SHA256: 60121B5005A86DEB10CC5DB397C86609CD954875987FA9625C55DA7034C76709
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### MachtigingOnline SSCD CA - G2

- Subject: countryName=NL, organizationName=Digidentity B.V., commonName=MachtigingOnline SSCD CA - G2
- Issuer: countryName=NL, organizationName=Digidentity B.V., commonName=Digidentity Organisatie CA - G2
- Serial: 0D
- SHA-256: 6622353890E7CFFBA0A51194377BBE59DD8C283AFD3C075193383D812FD3F1D9
- SPKI SHA-256: 60121B5005A86DEB10CC5DB397C86609CD954875987FA9625C55DA7034C76709
- Validity: 2011-09-27 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://pki.digidentity.eu/L4/organisatie/latestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 13 (0xd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Digidentity B.V., CN = Digidentity Organisatie CA - G2
        Validity
            Not Before: Sep 27 16:11:15 2011 GMT
            Not After : Mar 23 09:49:33 2020 GMT
        Subject: C = NL, O = Digidentity B.V., CN = MachtigingOnline SSCD CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C0:37:B7:FE:70:1C:D8:99:6C:51:BE:E7:64:73:AF:0B:33:AB:CC:E1
            X509v3 Authority Key Identifier:
                8F:5D:E9:0C:81:51:6E:9A:80:D2:88:D9:DB:B3:C7:DB:F9:08:FA:EB
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.digidentity.eu/validatie
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.digidentity.eu/L4/organisatie/latestCRL.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6622353890E7CFFBA0A51194377BBE59DD8C283AFD3C075193383D812FD3F1D9
    SPKI SHA256: 60121B5005A86DEB10CC5DB397C86609CD954875987FA9625C55DA7034C76709
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://pki.digidentity.eu/L4/organisatie/latestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### MinIenM Autonome Apparaten CA - G2

- Subject: countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Autonome Apparaten CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Autonome Apparaten CA - G2
- Serial: 01313B13
- SHA-256: 3B011284D8EBE902841CEC48F9D7F18BEF71BA404835717D5D2BEF5655710793
- SPKI SHA-256: 773C6E40D79697C1AE44AA57D65797E6A2274516E1EE2A47E4C087206FEAF137
- Validity: 2012-03-08 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Ministerie van Infrastructuur en Waterstaat
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, http://bct.csp.minienm.nl/minienm-bct-cps/minienm-bct-cps.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bct.tsp.minienw.nl/ETS034MinIenW.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomAutonomeApparatenLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003603 (0x1313b13)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Autonome Apparaten CA - G2
        Validity
            Not Before: Mar  8 10:58:04 2012 GMT
            Not After : Mar 23 10:54:27 2020 GMT
        Subject: C = NL, O = Ministerie van Infrastructuur en Milieu, CN = MinIenM Autonome Apparaten CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://csp.minienm.nl/minienm-cps/
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-10
            Authority Information Access:
                CA Issuers - URI:http://www.pkioverheid.nl/AACA-G2.cer
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:7D:76:81:96:1E:4A:29:D1:CE:5E:12:0A:2A:D4:D1:D4:ED:BC:ED:99
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:97:BB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomAutonomeApparatenLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                A0:4B:BB:75:DD:8A:6C:65:94:7E:7F:B3:28:34:A3:25:75:69:CD:C2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3B011284D8EBE902841CEC48F9D7F18BEF71BA404835717D5D2BEF5655710793
    SPKI SHA256: 773C6E40D79697C1AE44AA57D65797E6A2274516E1EE2A47E4C087206FEAF137
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://www.pkioverheid.nl/AACA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomAutonomeApparatenLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MinIenM Organisatie CA - G2

- Subject: countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 0131377B
- SHA-256: BDD191FD3B4AC34B4D2F62EFAFBD07CEAB6581BCFE6C129F5916F1892FBD5394
- SPKI SHA-256: 8E044F1927E2A8FE288EEE53BDB3689F9B1C3CDAEC8F1A1A6DEC5C8383D1D9D9
- Validity: 2012-03-08 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Ministerie van Infrastructuur en Waterstaat
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, http://bct.csp.minienm.nl/minienm-bct-cps/minienm-bct-cps.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bct.tsp.minienw.nl/ETS034MinIenW.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002683 (0x131377b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Mar  8 10:12:40 2012 GMT
            Not After : Mar 23 10:08:39 2020 GMT
        Subject: C = NL, O = Ministerie van Infrastructuur en Milieu, CN = MinIenM Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://csp.minienm.nl/minienm-cps/
            X509v3 Subject Alternative Name:
                DirName:/CN=prv4096-9
            X509v3 Basic Constraints: critical
                CA:TRUE
            Authority Information Access:
                CA Issuers - URI:http://www.pkioverheid.nl/OrgCA-G2.cer
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                28:96:63:C1:5D:9B:6D:40:B1:4F:51:0C:EA:41:A1:95:78:94:46:3A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BDD191FD3B4AC34B4D2F62EFAFBD07CEAB6581BCFE6C129F5916F1892FBD5394
    SPKI SHA256: 8E044F1927E2A8FE288EEE53BDB3689F9B1C3CDAEC8F1A1A6DEC5C8383D1D9D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://www.pkioverheid.nl/OrgCA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MinIenM Taxi CA Boordcomputerkaarten - G2

- Subject: countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Taxi CA Boordcomputerkaarten - G2
- Issuer: countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Organisatie CA - G2
- Serial: 0DFA79162B42163347FE8E593A849ECE
- SHA-256: C0E1A932482E0720AF1719770533382BB724413CD076BF8A56B5CAF45F297E2A
- SPKI SHA-256: F020EA352615B3E7ECC173B2807CE5D170BD8699835C958A922AC1AC4917851C
- Validity: 2012-03-09 to 2020-03-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://csp.minienm.nl/minienm-org-ca-1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:fa:79:16:2b:42:16:33:47:fe:8e:59:3a:84:9e:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Ministerie van Infrastructuur en Milieu, CN = MinIenM Organisatie CA - G2
        Validity
            Not Before: Mar  9 00:00:00 2012 GMT
            Not After : Mar 21 23:59:59 2020 GMT
        Subject: C = NL, O = Ministerie van Infrastructuur en Milieu, CN = MinIenM Taxi CA Boordcomputerkaarten - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://csp.minienm.nl/minienm-org-ca-1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://bct.csp.minienm.nl/minienm-bct-cps/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://csp.minienm.nl/minienm-org-ca-1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                3B:C7:60:6E:E4:EE:A2:2B:74:FF:8D:1A:BC:E4:47:93:03:C2:9E:9D
            X509v3 Authority Key Identifier:
                28:96:63:C1:5D:9B:6D:40:B1:4F:51:0C:EA:41:A1:95:78:94:46:3A
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C0E1A932482E0720AF1719770533382BB724413CD076BF8A56B5CAF45F297E2A
    SPKI SHA256: F020EA352615B3E7ECC173B2807CE5D170BD8699835C958A922AC1AC4917851C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://csp.minienm.nl/minienm-org-ca-1.cer
- CRL Distribution Points: http://csp.minienm.nl/minienm-org-ca-1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MinIenM Taxi CA Systeemkaarten - G2

- Subject: countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Taxi CA Systeemkaarten - G2
- Issuer: countryName=NL, organizationName=Ministerie van Infrastructuur en Milieu, commonName=MinIenM Autonome Apparaten CA - G2
- Serial: 35FC71CFCC0CCF7E990A147DD8D4CA9F
- SHA-256: 7415FC604086B4E9A7DBCF8B44AB9A478D337F506477E3D48880D4432810DD6B
- SPKI SHA-256: 9DD002A9F1D92917AB59471A1248CBBE2EAD17ABF4DC95F63DB02AFC0AA52B90
- Validity: 2012-03-09 to 2020-03-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://csp.minienm.nl/minienm-aa-ca-1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:fc:71:cf:cc:0c:cf:7e:99:0a:14:7d:d8:d4:ca:9f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Ministerie van Infrastructuur en Milieu, CN = MinIenM Autonome Apparaten CA - G2
        Validity
            Not Before: Mar  9 00:00:00 2012 GMT
            Not After : Mar 21 23:59:59 2020 GMT
        Subject: C = NL, O = Ministerie van Infrastructuur en Milieu, CN = MinIenM Taxi CA Systeemkaarten - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://csp.minienm.nl/minienm-aa-ca-1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://bct.csp.minienm.nl/minienm-bct-cps/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://csp.minienm.nl/minienm-aa-ca-1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                44:98:A8:11:0F:DD:A5:E4:0C:11:D0:22:39:54:09:48:23:16:76:63
            X509v3 Authority Key Identifier:
                A0:4B:BB:75:DD:8A:6C:65:94:7E:7F:B3:28:34:A3:25:75:69:CD:C2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7415FC604086B4E9A7DBCF8B44AB9A478D337F506477E3D48880D4432810DD6B
    SPKI SHA256: 9DD002A9F1D92917AB59471A1248CBBE2EAD17ABF4DC95F63DB02AFC0AA52B90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://csp.minienm.nl/minienm-aa-ca-1.cer
- CRL Distribution Points: http://csp.minienm.nl/minienm-aa-ca-1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### MinIenW PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=Ministerie van Infrastructuur en Waterstaat, organizationIdentifier=NTRNL-52766179, commonName=MinIenW PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 35C18872BA36292E
- SHA-256: 0664F1EEEED1A7355700201D2F4431DC43B0BCEAB129A8CABFD4ED87D04341EF
- SPKI SHA-256: 80EAA9648A073BE4CEDBE8E2586397FF19C92A9FE2BA70359E3E759795D810A9
- Validity: 2019-02-28 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, http://bct.csp.minienm.nl/minienm-bct-cps/minienm-bct-cps.pdf
- CP/CPS same as parent: false
- Audit URLs: http://csp.minienm.nl/ETS034MinIenM.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3873527180847098158 (0x35c18872ba36292e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Feb 28 10:18:58 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Ministerie van Infrastructuur en Waterstaat, organizationIdentifier = NTRNL-52766179, CN = MinIenW PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                60:01:27:1A:B1:40:36:C8:87:9B:D7:1C:A6:B7:BC:BB:D3:D7:83:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0664F1EEEED1A7355700201D2F4431DC43B0BCEAB129A8CABFD4ED87D04341EF
    SPKI SHA256: 80EAA9648A073BE4CEDBE8E2586397FF19C92A9FE2BA70359E3E759795D810A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### MinIenW PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=Ministerie van Infrastructuur en Waterstaat, organizationIdentifier=NTRNL-52766179, commonName=MinIenW PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 79CB0F74804B6A14
- SHA-256: 16C94A8CCC15C983825B5BD3F2DC68D694C8A320F2328ECD8C9CA57DE51DA0E5
- SPKI SHA-256: F45109C3088B18CC9AE8F6B22E1B0A2DFAC7DA8FA3BF9987B86DADF5B6AD05E5
- Validity: 2019-02-28 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, http://bct.csp.minienm.nl/minienm-bct-cps/minienm-bct-cps.pdf
- CP/CPS same as parent: false
- Audit URLs: http://csp.minienm.nl/ETS034MinIenM.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8776125291904592404 (0x79cb0f74804b6a14)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Feb 28 09:48:52 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Ministerie van Infrastructuur en Waterstaat, organizationIdentifier = NTRNL-52766179, CN = MinIenW PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                F9:9F:2D:A3:B9:9D:75:7C:43:58:FE:82:A0:68:0D:C4:DE:0A:9A:52
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 16C94A8CCC15C983825B5BD3F2DC68D694C8A320F2328ECD8C9CA57DE51DA0E5
    SPKI SHA256: F45109C3088B18CC9AE8F6B22E1B0A2DFAC7DA8FA3BF9987B86DADF5B6AD05E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Ministerie van Defensie Certificatie Autoriteit - G2

- Subject: countryName=NL, organizationName=Ministerie van Defensie, commonName=Ministerie van Defensie Certificatie Autoriteit - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 0131354B
- SHA-256: 35FE6E6BA2005B9EAAAEAB9CEC07B6A6B6BD936F3EADC5C37B5B8ADC59760BFD
- SPKI SHA-256: 4E475A91DCC16532A6EE71C598F6E46F0DB1DDFBEBBAAF76F4CD8D23F811B617
- Validity: 2010-11-10 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Ministerie van Defensie
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://cps.dp.ca.mindef.nl/2019-10-17_CPS_G2_Certification_Authority_Ministry_of_Defence_v2.10.3_EN..._DO_AvdS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://cps.dp.ca.mindef.nl/certificeringen/ETS%20044.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20002123 (0x131354b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Nov 10 09:34:25 2010 GMT
            Not After : Mar 23 09:31:44 2020 GMT
        Subject: C = NL, O = Ministerie van Defensie, CN = Ministerie van Defensie Certificatie Autoriteit - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.ca.mindef.nl/mindef-ca-cps/
            Authority Information Access:
                CA Issuers - URI:http://www.pkioverheid.nl/OrgCA-G2.cer
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                CE:59:FD:59:23:F3:D8:CE:B8:46:5D:87:61:FD:BF:28:3F:12:B6:64
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 35FE6E6BA2005B9EAAAEAB9CEC07B6A6B6BD936F3EADC5C37B5B8ADC59760BFD
    SPKI SHA256: 4E475A91DCC16532A6EE71C598F6E46F0DB1DDFBEBBAAF76F4CD8D23F811B617
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://www.pkioverheid.nl/OrgCA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Ministerie van Defensie Certificatie Autoriteit Defensiepas - G2

- Subject: countryName=NL, organizationName=Ministerie van Defensie, commonName=Ministerie van Defensie Certificatie Autoriteit Defensiepas - G2
- Issuer: countryName=NL, organizationName=Ministerie van Defensie, commonName=Ministerie van Defensie Certificatie Autoriteit - G2
- Serial: 2E11232C15D59733D1CB7DEF514FE305
- SHA-256: F50CE647CFE32AC2D323539B35F073E74706ADCAAD1C85E12E2AAF041474B71D
- SPKI SHA-256: 2254250A5BEB5F45744E0EE00ED8DB55FA5D508E1AF879D9B170E1BD5C204F90
- Validity: 2010-11-16 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ca.mindef.nl/mindef-ca-2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:11:23:2c:15:d5:97:33:d1:cb:7d:ef:51:4f:e3:05
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Ministerie van Defensie, CN = Ministerie van Defensie Certificatie Autoriteit - G2
        Validity
            Not Before: Nov 16 14:29:29 2010 GMT
            Not After : Mar 22 09:31:00 2020 GMT
        Subject: C = NL, O = Ministerie van Defensie, CN = Ministerie van Defensie Certificatie Autoriteit Defensiepas - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://certs.ca.mindef.nl/mindef-ca-2.cer
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://cps.dp.ca.mindef.nl/mindef-ca-dp-cps/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ca.mindef.nl/mindef-ca-2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B6:B9:51:EA:EE:8A:CF:18:44:87:85:EE:BF:EE:C4:8E:49:E5:4E:2A
            X509v3 Authority Key Identifier:
                CE:59:FD:59:23:F3:D8:CE:B8:46:5D:87:61:FD:BF:28:3F:12:B6:64
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F50CE647CFE32AC2D323539B35F073E74706ADCAAD1C85E12E2AAF041474B71D
    SPKI SHA256: 2254250A5BEB5F45744E0EE00ED8DB55FA5D508E1AF879D9B170E1BD5C204F90
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://certs.ca.mindef.nl/mindef-ca-2.cer
- CRL Distribution Points: http://crls.ca.mindef.nl/mindef-ca-2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Ministerie van Defensie PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=Ministerie van Defensie, organizationIdentifier=NTRNL-27370985, commonName=Ministerie van Defensie PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 2A41257774A0AC234977FE3A77B9E67E79F57D4D
- SHA-256: 5F6CAA44A4663C441DD92C8B6655FBF97CF6E1D6934DB8F5F8D97ADF7033FAAC
- SPKI SHA-256: ECA60BCF1E50473BBE6AEFE00B04D366A0A1E85B126C9C5435A35ED0DC5B3146
- Validity: 2019-06-27 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Ministerie van Defensie
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.3.pdf, https://cps.ca.pkidefensie.nl/cps-mindef.pdf; https://cps.ca.pkidefensie.nl/cps-mindef.pdf
- CP/CPS same as parent: false
- Audit URLs: https://attestic.eu/wp-content/uploads/2026/02/CT-014-Mindef-2026-02-Certificate-ETSI-319-411-1-v1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: https://crls.ca.pkidefensie.nl/mindef-ca-3-latest.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2a:41:25:77:74:a0:ac:23:49:77:fe:3a:77:b9:e6:7e:79:f5:7d:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Jun 27 08:49:06 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = Ministerie van Defensie, organizationIdentifier = NTRNL-27370985, CN = Ministerie van Defensie PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                23:BB:F9:DF:80:89:13:A3:77:27:E9:C6:69:43:33:8D:49:07:C2:6A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5F6CAA44A4663C441DD92C8B6655FBF97CF6E1D6934DB8F5F8D97ADF7033FAAC
    SPKI SHA256: ECA60BCF1E50473BBE6AEFE00B04D366A0A1E85B126C9C5435A35ED0DC5B3146
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### QuoVadis CSP - PKI Overheid CA - G2

- Subject: countryName=NL, organizationName=QuoVadis Trustlink BV, organizationalUnitName=Issuing Certification Authority, commonName=QuoVadis CSP - PKI Overheid CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 01313312
- SHA-256: 2AA5350D04FF5F36EBCAA327F0A4752D1A061750D8CE6D9E7937A6224DDB12A4
- SPKI SHA-256: F966C85474B321CD45BC7E8DF558C428445524701E7C620AD1BB963F620AA662
- Validity: 2009-07-14 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: QuoVadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203e%20Server%20V1.9.ashx
- CP/CPS same as parent: false
- Audit URLs: https://www.quovadisglobal.nl/~/media/Files/Files_Global/QuoVadis_ETS_030.ashx
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20001554 (0x1313312)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Jul 14 09:02:23 2009 GMT
            Not After : Mar 23 10:00:52 2020 GMT
        Subject: C = NL, O = QuoVadis Trustlink BV, OU = Issuing Certification Authority, CN = QuoVadis CSP - PKI Overheid CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.quovadisglobal.com/repository
            X509v3 Basic Constraints: critical
                CA:TRUE
            Authority Information Access:
                CA Issuers - URI:https://www.pkioverheid.nl/fileadmin/PKI/PKI_certifcaten/staatdernederlandenorganisatieca-g2.crt
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                69:CB:7F:50:76:00:86:53:95:79:12:C1:58:76:1F:13:EF:F2:4D:A3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2AA5350D04FF5F36EBCAA327F0A4752D1A061750D8CE6D9E7937A6224DDB12A4
    SPKI SHA256: F966C85474B321CD45BC7E8DF558C428445524701E7C620AD1BB963F620AA662
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: https://www.pkioverheid.nl/fileadmin/PKI/PKI_certifcaten/staatdernederlandenorganisatieca-g2.crt
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_aia_access_location_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### QuoVadis CSP - PKI Overheid EV CA

- Subject: countryName=NL, organizationName=QuoVadis Trustlink BV, commonName=QuoVadis CSP - PKI Overheid EV CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Serial: 6B90CE02A49494B9B6B3A90BD31F2091
- SHA-256: DCA3AB942C24A13F168CAF79CD3300B0A3A3672755EEDC786AFD79C3CD73BF0D
- SPKI SHA-256: E6F4DA3E5583D0C1474DE63010E49C4205BA2C3260B01D278CC392438E61B5C9
- Validity: 2012-12-13 to 2022-12-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/Repository.aspx?sc_lang=en-GB
- CP/CPS same as parent: false
- Audit URLs: https://www.quovadisglobal.nl/Bedrijfsinformatie/Accreditaties.aspx
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:90:ce:02:a4:94:94:b9:b6:b3:a9:0b:d3:1f:20:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Validity
            Not Before: Dec 13 00:00:00 2012 GMT
            Not After : Dec  6 23:59:59 2022 GMT
        Subject: C = NL, O = QuoVadis Trustlink BV, CN = QuoVadis CSP - PKI Overheid EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: http://www.logius.nl/producten/toegang/pkioverheid/documentatie/cps
            X509v3 Subject Key Identifier:
                A3:22:61:A1:18:C8:DC:4C:CD:0C:55:3C:F7:E5:26:A5:3D:4C:F4:0A
            X509v3 Authority Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
            Authority Information Access:
                OCSP - URI:http://ocsp.pkioverheid.nl
                CA Issuers - URI:https://www.logius.nl/fileadmin/logius/product/pkioverheid/certificaten/Staat%20der%20Nederlanden%20EV%20Intermediair%20CA.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DCA3AB942C24A13F168CAF79CD3300B0A3A3672755EEDC786AFD79C3CD73BF0D
    SPKI SHA256: E6F4DA3E5583D0C1474DE63010E49C4205BA2C3260B01D278CC392438E61B5C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: http://ocsp.pkioverheid.nl
- AIA CA Issuers: https://www.logius.nl/fileadmin/logius/product/pkioverheid/certificaten/Staat%20der%20Nederlanden%20EV%20Intermediair%20CA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### QuoVadis CSP Burger CA - G2

- Subject: countryName=NL, organizationName=QuoVadis Trustlink BV, commonName=QuoVadis CSP Burger CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2
- Serial: 01313B3B
- SHA-256: DA89E17721513690FE115F5C23F0CB76B6D6E258540A85F8537511EA720056C6
- SPKI SHA-256: A14EB48F0C7A02CE1BB7E04B7287CDFBEF8F64A671447179EBC936CFE52D4A3C
- Validity: 2014-04-09 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Burger%203c%20V1.3.ashx
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20003643 (0x1313b3b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G2
        Validity
            Not Before: Apr  9 09:04:35 2014 GMT
            Not After : Mar 23 10:02:29 2020 GMT
        Subject: C = NL, O = QuoVadis Trustlink BV, CN = QuoVadis CSP Burger CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: http://www.quovadisglobal.com/repository
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G2.cer
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                91:A5:0D:DD:1D:A0:D1:2A:68:A7:1B:8D:DB:48:9A:AA:34:A9:7F:96
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                B8:EF:6F:CF:94:D9:06:A7:F2:35:D0:F6:AC:62:15:A2:E0:FC:43:6B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DA89E17721513690FE115F5C23F0CB76B6D6E258540A85F8537511EA720056C6
    SPKI SHA256: A14EB48F0C7A02CE1BB7E04B7287CDFBEF8F64A671447179EBC936CFE52D4A3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G2.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### QuoVadis PKIoverheid Burger CA - 2021

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Burger CA - 2021
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 4959C844FBA7140010F2AADE5D3B4C2AD87AF018
- SHA-256: 3AC3DB2C474FC34FE8011C5A01F622824C6F8B11076F56192AC701DAE3D70534
- SPKI SHA-256: DFADEE06AF32AD9F8976A671C6A9162F4850E44F7BB4F8D0F5D959B6A6755A06
- Validity: 2021-02-25 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.quovadisglobal.com/quovadispkioverheidburgerca2021.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:59:c8:44:fb:a7:14:00:10:f2:aa:de:5d:3b:4c:2a:d8:7a:f0:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Feb 25 10:30:17 2021 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Burger CA - 2021
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                22:BA:E9:49:1E:EC:95:96:F1:FF:ED:F9:C3:86:58:BA:E9:EA:90:A1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3AC3DB2C474FC34FE8011C5A01F622824C6F8B11076F56192AC701DAE3D70534
    SPKI SHA256: DFADEE06AF32AD9F8976A671C6A9162F4850E44F7BB4F8D0F5D959B6A6755A06
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Burger CA - G3

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Serial: 371078197585E61B
- SHA-256: D41D23C51559F65E5C22503D7A7ABF5CD965EC39C61C698A7D98D797AF707B48
- SPKI SHA-256: C976DBABDED25379DA00E9BFF5BED9DDA6E36A5BBC7AFC0BF749AF479B58AF12
- Validity: 2016-11-03 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: QuoVadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Burger%203c%20V1.7.ashx
- CP/CPS same as parent: false
- Audit URLs: https://www.quovadisglobal.nl/~/media/Files/Files_Global/QuoVadis_ETS_030.ashx
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3967803322454631963 (0x371078197585e61b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Validity
            Not Before: Nov  3 12:54:29 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
            X509v3 Subject Key Identifier:
                F7:B7:AD:95:5F:56:47:8E:98:EE:67:0D:0F:C2:C6:F7:D9:D1:DB:C5
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D41D23C51559F65E5C22503D7A7ABF5CD965EC39C61C698A7D98D797AF707B48
    SPKI SHA256: C976DBABDED25379DA00E9BFF5BED9DDA6E36A5BBC7AFC0BF749AF479B58AF12
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomBurgerCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### QuoVadis PKIoverheid EV CA

- Subject: countryName=NL, organizationName=QuoVadis Trustlink BV, commonName=QuoVadis PKIoverheid EV CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Serial: 6685873DB7A94427D879CB372B6E0BC2
- SHA-256: ED3DB748D6D78EEFF0B9452BC6A02E039039C55075A439323B8BA85FB21B9DDA
- SPKI SHA-256: FF833C7E27A04951F0321C5E5D71B48474E389CC6B3F832870C7E70F346F7B86
- Validity: 2015-03-05 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: QuoVadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_EV%203F%20V1.7.ashx
- CP/CPS same as parent: false
- Audit URLs: https://www.quovadisglobal.nl/~/media/Files/Files_Global/QuoVadis_ETS_030.ashx
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:85:87:3d:b7:a9:44:27:d8:79:cb:37:2b:6e:0b:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Validity
            Not Before: Mar  5 00:00:00 2015 GMT
            Not After : Dec  5 23:59:59 2022 GMT
        Subject: C = NL, O = QuoVadis Trustlink BV, CN = QuoVadis PKIoverheid EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: https://cps.pkioverheid.nl
            X509v3 Subject Key Identifier:
                94:FF:E7:6E:0B:A9:6F:E3:E1:91:59:CA:08:5E:CD:B7:C5:08:3C:69
            X509v3 Authority Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
            Authority Information Access:
                OCSP - URI:http://ocsp.pkioverheid.nl
                CA Issuers - URI:https://cert.pkioverheid.nl/EVIntermediairCA.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ED3DB748D6D78EEFF0B9452BC6A02E039039C55075A439323B8BA85FB21B9DDA
    SPKI SHA256: FF833C7E27A04951F0321C5E5D71B48474E389CC6B3F832870C7E70F346F7B86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: http://ocsp.pkioverheid.nl
- AIA CA Issuers: https://cert.pkioverheid.nl/EVIntermediairCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVIntermediairLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 
- [historical] warn w_ext_aia_access_location_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### QuoVadis PKIoverheid Organisatie Persoon CA - 2022

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Persoon CA - 2022
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 73F5E35639D5880C6EEEEFFD94B33F5A56B7EE9F
- SHA-256: 56521521E7EA27EAAE33F0095D5B871CDA3AF4A80A62E08594CBAD6EF2806307
- SPKI SHA-256: F1DDB7825E8C43267E1EF5A5D3468EED27F88DE55310C2B3197A663103968CCD
- Validity: 2022-01-27 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.quovadisglobal.com/quovadispkioverheidorganisatiepersoonca2022.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:f5:e3:56:39:d5:88:0c:6e:ee:ef:fd:94:b3:3f:5a:56:b7:ee:9f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Jan 27 11:17:54 2022 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Persoon CA - 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                15:D6:73:7E:78:7F:3B:FA:96:99:6A:E3:30:F8:37:33:56:36:2E:37
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.3
                Policy: 0.4.0.2042.1.2
                Policy: 0.4.0.194112.1.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 56521521E7EA27EAAE33F0095D5B871CDA3AF4A80A62E08594CBAD6EF2806307
    SPKI SHA256: F1DDB7825E8C43267E1EF5A5D3468EED27F88DE55310C2B3197A663103968CCD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 0.4.0.2042.1.2, 0.4.0.194112.1.2
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 24A7A2B620F903E3
- SHA-256: 15073C6BBDC74699A88518C27A57C956E5E23D6CA9619E521A468C7873DE4F8A
- SPKI SHA-256: E55D496986BEEAFDA816831789FBA1AE375E6B776BC6D56BF65AB388F4C257D3
- Validity: 2016-11-03 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.1.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf; https://www.digicert.com/content/dam/digicert/pdfs/legal/quovadis/digicert-pkioverheid-cps-v2-02-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.quovadisglobal.com/pkiopersong3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2641258609597023203 (0x24a7a2b620f903e3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Nov  3 12:39:41 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                51:A8:6B:F7:82:24:94:E8:8B:A3:B6:29:3B:8E:B6:B2:9D:28:F9:8B
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 15073C6BBDC74699A88518C27A57C956E5E23D6CA9619E521A468C7873DE4F8A
    SPKI SHA256: E55D496986BEEAFDA816831789FBA1AE375E6B776BC6D56BF65AB388F4C257D3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 3411DADD551C7849
- SHA-256: 85363A24CB1B66E6CF6244E87D243DBB8306F607357C614CB9C4C224A0E04358
- SPKI SHA-256: D110CF9A26797212E32E5D331C201AACF878DB6F40F4EDD2D36CC45C430E64BE
- Validity: 2016-11-03 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: QuoVadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_PKIo_CPS%20v1.5_final.ashx
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9198675
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3752020608726890569 (0x3411dadd551c7849)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Nov  3 14:12:11 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                B7:E9:D0:E9:FF:67:0E:D9:9C:0C:07:2E:97:D4:7E:4B:79:78:F4:20
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 85363A24CB1B66E6CF6244E87D243DBB8306F607357C614CB9C4C224A0E04358
    SPKI SHA256: D110CF9A26797212E32E5D331C201AACF878DB6F40F4EDD2D36CC45C430E64BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Organisatie Server CA - G3

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Server CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 74CAD9C8656B3F5DC8826DDF11D1AA48634EB737
- SHA-256: CE2332390208742A1ACA6513974C4C9DB2691EAF4568B533E4A17ED5DDA973E6
- SPKI SHA-256: D110CF9A26797212E32E5D331C201AACF878DB6F40F4EDD2D36CC45C430E64BE
- Validity: 2019-04-17 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: QuoVadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_PKIo_CPS%20v1.5_final.ashx
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9198675
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:ca:d9:c8:65:6b:3f:5d:c8:82:6d:df:11:d1:aa:48:63:4e:b7:37
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Apr 17 08:07:43 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Server CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                B7:E9:D0:E9:FF:67:0E:D9:9C:0C:07:2E:97:D4:7E:4B:79:78:F4:20
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CE2332390208742A1ACA6513974C4C9DB2691EAF4568B533E4A17ED5DDA973E6
    SPKI SHA256: D110CF9A26797212E32E5D331C201AACF878DB6F40F4EDD2D36CC45C430E64BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, OCSP Signing, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Organisatie Services CA - 2022

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Services CA - 2022
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 3928F53322DDA03CD3BD5A2FE5CA5C2D384476DB
- SHA-256: B0D9AFDA74163609E4EAB017EEE4CE0B235AEEF7D68C06F86E74C6387999B2B7
- SPKI SHA-256: A563AF0034B113510CBA10A0D7512DF3D89880FD7B524AE53F1B0C195956CE59
- Validity: 2022-01-27 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.1.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf; https://www.digicert.com/content/dam/digicert/pdfs/legal/quovadis/digicert-pkioverheid-cps-v2-02-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.quovadisglobal.com/quovadispkioverheidorganisatieservicesca2022.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7, 0.4.0.2042.1.2, 0.4.0.194112.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:28:f5:33:22:dd:a0:3c:d3:bd:5a:2f:e5:ca:5c:2d:38:44:76:db
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Jan 27 10:17:49 2022 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Services CA - 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
            X509v3 Subject Key Identifier:
                58:2E:4A:59:AA:6D:77:74:E0:B3:9C:E4:62:96:5F:B1:F4:6D:45:AD
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.5
                Policy: 2.16.528.1.1003.1.2.5.7
                Policy: 0.4.0.2042.1.2
                Policy: 0.4.0.194112.1.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B0D9AFDA74163609E4EAB017EEE4CE0B235AEEF7D68C06F86E74C6387999B2B7
    SPKI SHA256: A563AF0034B113510CBA10A0D7512DF3D89880FD7B524AE53F1B0C195956CE59
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7, 0.4.0.2042.1.2, 0.4.0.194112.1.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 7BD2531817B8E72C
- SHA-256: C17397A61D9AF9D2A229CCF262AB1D32B4A987A134AE5BD9DE4FC155F00DD16E
- SPKI SHA-256: C69779EA04E85E524FAC93BAAF3FD9E91C1C577D18750DB2B0C39F723CE96663
- Validity: 2016-11-03 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203b%20Service%20V1.4.ashx
- CP/CPS same as parent: false
- Audit URLs: https://www.quovadisglobal.nl/~/media/Files/Files_Global/ETS%20010%20eCertificate.ashx
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8922285174716688172 (0x7bd2531817b8e72c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Nov  3 11:19:03 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                EE:AA:AD:3D:9E:62:2C:5A:46:23:77:60:C3:22:28:34:A3:63:04:F4
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C17397A61D9AF9D2A229CCF262AB1D32B4A987A134AE5BD9DE4FC155F00DD16E
    SPKI SHA256: C69779EA04E85E524FAC93BAAF3FD9E91C1C577D18750DB2B0C39F723CE96663
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., organizationIdentifier=NTRNL-30237459, commonName=QuoVadis PKIoverheid Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 4B22DF24709277E9
- SHA-256: BECFDE124CEDD344D925CB55EDDA662D9A9C0688FA9A0870CE3DBB6DA4313E4E
- SPKI SHA-256: 0DDDDD2F787B33028BE7B013ED20C05CB72706CBFE17E352B23BBD1C37E72143
- Validity: 2016-11-03 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: DigiCert Europe Netherlands B.V.
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.1.pdf, https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-pkioverheid-cps-v2.05.pdf; https://www.digicert.com/content/dam/digicert/pdfs/legal/quovadis/digicert-pkioverheid-cps-v2-02-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ets_030.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.quovadisglobal.com/pkioservicg3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5414135049653221353 (0x4b22df24709277e9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Nov  3 14:03:26 2016 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., organizationIdentifier = NTRNL-30237459, CN = QuoVadis PKIoverheid Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                CA:E2:2B:EC:95:3E:5A:A1:48:8C:C7:E4:BC:D2:54:6C:C6:EB:65:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BECFDE124CEDD344D925CB55EDDA662D9A9C0688FA9A0870CE3DBB6DA4313E4E
    SPKI SHA256: 0DDDDD2F787B33028BE7B013ED20C05CB72706CBFE17E352B23BBD1C37E72143
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### QuoVadis PKIoverheid Server CA 2020

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., commonName=QuoVadis PKIoverheid Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Serial: 28526A1DA96593D34558B664A321CAA838C15777
- SHA-256: EB2C2A806C69FC963C4E24A5BBEA20ED4E3B86AE798730BB4EEA51BF9DE33325
- SPKI SHA-256: 52BBB80D6C7E37E26ED4B30E0541EBF25D4616A529D12D887A788D75424C9FE6
- Validity: 2020-07-29 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Quo Vadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.com/wp-content/uploads/2022/06/QV_PKIo_CPS-v1.13_Approved.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/qv_hol-0047309378-000/ecertificate_-_ets_030.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.quovadisglobal.com/quovadispkioverheidserverca2020.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:52:6a:1d:a9:65:93:d3:45:58:b6:64:a3:21:ca:a8:38:c1:57:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Validity
            Not Before: Jul 29 18:30:06 2020 GMT
            Not After : Dec  5 00:00:00 2022 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., CN = QuoVadis PKIoverheid Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomeinServerCA2020.cer
                OCSP - URI:http://domserver2020ocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                22:B7:3D:C0:4E:66:6F:58:A8:73:B0:12:DF:FF:BB:D3:8E:13:98:E7
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EB2C2A806C69FC963C4E24A5BBEA20ED4E3B86AE798730BB4EEA51BF9DE33325
    SPKI SHA256: 52BBB80D6C7E37E26ED4B30E0541EBF25D4616A529D12D887A788D75424C9FE6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomeinServerCA2020.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### QuoVadis PKIoverheid Server CA 2020

- Subject: countryName=NL, organizationName=QuoVadis Trustlink B.V., commonName=QuoVadis PKIoverheid Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Serial: 0C71B917B97E276D3B444A97E8FD76F5D0A63356
- SHA-256: 5E99DD4A92307B92C495C56E24241DD79B4579D3CD0AD1ECC6D9D24A7981CA98
- SPKI SHA-256: 52BBB80D6C7E37E26ED4B30E0541EBF25D4616A529D12D887A788D75424C9FE6
- Validity: 2020-07-28 to 2022-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Quo Vadis Trustlink B.V.
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.quovadisglobal.nl/~/media/Files/Repository/QV_CPS_PKI_Overheid_Organisatie%203e%20Server%20V1.9.ashx
- CP/CPS same as parent: false
- Audit URLs: https://www.quovadisglobal.nl/~/media/Files/Files_Global/QuoVadis_ETS_030.ashx
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:71:b9:17:b9:7e:27:6d:3b:44:4a:97:e8:fd:76:f5:d0:a6:33:56
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Validity
            Not Before: Jul 28 12:12:20 2020 GMT
            Not After : Dec  5 00:00:00 2022 GMT
        Subject: C = NL, O = QuoVadis Trustlink B.V., CN = QuoVadis PKIoverheid Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomeinServerCA2020.cer
                OCSP - URI:http://domserver2020ocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                22:B7:3D:C0:4E:66:6F:58:A8:73:B0:12:DF:FF:BB:D3:8E:13:98:E7
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5E99DD4A92307B92C495C56E24241DD79B4579D3CD0AD1ECC6D9D24A7981CA98
    SPKI SHA256: 52BBB80D6C7E37E26ED4B30E0541EBF25D4616A529D12D887A788D75424C9FE6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- AIA OCSP: http://domserver2020ocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomeinServerCA2020.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Staat der Nederlanden Autonome Apparaten CA - G2

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Autonome Apparaten CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G2
- Serial: 9897BB
- SHA-256: 1B17100264247D7090036116238C93F45853EDE5AEA6F9F1A4524F6978DD8954
- SPKI SHA-256: A6D070483BEBF69E01C6C7F936C4603193A115ED007C26124FA7B1027C92872E
- Validity: 2009-11-03 to 2020-03-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000315 (0x9897bb)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G2
        Validity
            Not Before: Nov  3 13:35:47 2009 GMT
            Not After : Mar 24 13:34:41 2020 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Autonome Apparaten CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.pkioverheid.nl/policies/dom-aa-policy-G2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                91:68:32:87:15:1D:89:E2:B5:F1:AC:36:28:34:8D:0B:7C:62:88:EB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                7D:76:81:96:1E:4A:29:D1:CE:5E:12:0A:2A:D4:D1:D4:ED:BC:ED:99
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1B17100264247D7090036116238C93F45853EDE5AEA6F9F1A4524F6978DD8954
    SPKI SHA256: A6D070483BEBF69E01C6C7F936C4603193A115ED007C26124FA7B1027C92872E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Staat der Nederlanden Autonome Apparaten CA - G3

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Autonome Apparaten CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 98A2A0
- SHA-256: AD493D6E85EC608AB813A887BDC4D4196A0BC9B33D2565A7FA8AC430F08A99A5
- SPKI SHA-256: 4164EB61228864E9213E0C602BEBA03612C060F33ECDAE8E1786763551FF3B15
- Validity: 2013-11-15 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/DomAutonomeApparatenLatestCRL-G3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.6.1, 2.16.528.1.1003.1.2.6.2, 2.16.528.1.1003.1.2.6.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10003104 (0x98a2a0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Nov 15 09:04:59 2013 GMT
            Not After : Nov 12 23:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Autonome Apparaten CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.6.1
                Policy: 2.16.528.1.1003.1.2.6.2
                Policy: 2.16.528.1.1003.1.2.6.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                6D:1B:25:02:5D:E0:48:F4:6E:13:75:E2:57:84:9D:50:F3:30:14:43
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AD493D6E85EC608AB813A887BDC4D4196A0BC9B33D2565A7FA8AC430F08A99A5
    SPKI SHA256: 4164EB61228864E9213E0C602BEBA03612C060F33ECDAE8E1786763551FF3B15
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.6.1, 2.16.528.1.1003.1.2.6.2, 2.16.528.1.1003.1.2.6.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_sub_ca_aia_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Staat der Nederlanden Burger CA - G2

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G2
- Serial: 9896F3
- SHA-256: 2F2F0C844FB336A9421AB6FA36DCDAC3BB84E0384CFF5DAD51113C8CA424E6A4
- SPKI SHA-256: 81649653BBCC73A02643859D0781D2B5D41F79D0438ED0589970F4200ACE9A34
- Validity: 2008-03-31 to 2020-03-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000115 (0x9896f3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G2
        Validity
            Not Before: Mar 31 10:45:11 2008 GMT
            Not After : Mar 24 11:43:57 2020 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.pkioverheid.nl/policies/dom-bu-policy-G2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                91:68:32:87:15:1D:89:E2:B5:F1:AC:36:28:34:8D:0B:7C:62:88:EB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                91:A5:0D:DD:1D:A0:D1:2A:68:A7:1B:8D:DB:48:9A:AA:34:A9:7F:96
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2F2F0C844FB336A9421AB6FA36DCDAC3BB84E0384CFF5DAD51113C8CA424E6A4
    SPKI SHA256: 81649653BBCC73A02643859D0781D2B5D41F79D0438ED0589970F4200ACE9A34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Staat der Nederlanden Burger CA - G3

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Burger CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 98A247
- SHA-256: 2E7A0A3B0C527EB20C52253C8D2278CA108136A8CA3A4EA22DA7B59BAC90650A
- SPKI SHA-256: 0DDB66CBA3DAFA98A36F57E0647AC406B46E8CDC1C1FDDB4FB9B9C3A11C6E325
- Validity: 2013-11-14 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/DomBurgerLatestCRL-G3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10003015 (0x98a247)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Nov 14 16:08:12 2013 GMT
            Not After : Nov 12 23:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Burger CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.1
                Policy: 2.16.528.1.1003.1.2.3.2
                Policy: 2.16.528.1.1003.1.2.3.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                FF:68:75:42:7D:FA:6F:C7:5A:93:38:9F:35:44:D0:AA:2D:00:B2:89
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E7A0A3B0C527EB20C52253C8D2278CA108136A8CA3A4EA22DA7B59BAC90650A
    SPKI SHA256: 0DDB66CBA3DAFA98A36F57E0647AC406B46E8CDC1C1FDDB4FB9B9C3A11C6E325
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.3.1, 2.16.528.1.1003.1.2.3.2, 2.16.528.1.1003.1.2.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_sub_ca_aia_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Staat der Nederlanden Citizen CA - 2023

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Citizen CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 352EF9FD94BA19644EA29A42E4A8931EEFB3FBDA
- SHA-256: A67A56A183EDE6EB89CB85A85BCD52CE1EF925251AA239AD25616C12C8088C06
- SPKI SHA-256: BAD76764CBBC01AB15DEC37C266F3901245E3ECFAFA290066363DAFCF7D84772
- Validity: 2023-10-31 to 2028-11-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Government of The Netherlands, PKIoverheid (Logius)
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.pkioverheid.nl/DomCitizenLatestCRL-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.4, 2.16.528.1.1003.1.2.3.5, 2.16.528.1.1003.1.2.3.6, 0.4.0.194112.1.2, 0.4.0.2042.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:2e:f9:fd:94:ba:19:64:4e:a2:9a:42:e4:a8:93:1e:ef:b3:fb:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Oct 31 11:08:21 2023 GMT
            Not After : Nov 13 00:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Citizen CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/RootCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.3.4
                Policy: 2.16.528.1.1003.1.2.3.5
                Policy: 2.16.528.1.1003.1.2.3.6
                  CPS: https://cps.pkioverheid.nl
                Policy: 0.4.0.194112.1.2
                Policy: 0.4.0.2042.1.2
            X509v3 Extended Key Usage:
                1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                99:68:DB:4E:82:3D:34:BE:CF:87:EB:27:41:92:7A:4E:3D:9D:A8:47
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A67A56A183EDE6EB89CB85A85BCD52CE1EF925251AA239AD25616C12C8088C06
    SPKI SHA256: BAD76764CBBC01AB15DEC37C266F3901245E3ECFAFA290066363DAFCF7D84772
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.3.4, 2.16.528.1.1003.1.2.3.5, 2.16.528.1.1003.1.2.3.6, 0.4.0.194112.1.2, 0.4.0.2042.1.2
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/RootCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Staat der Nederlanden Domein Server CA 2020

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA
- Serial: 1E535AFF7FFA767344A85B524AD9D0297D5DBA65
- SHA-256: FEF634033A8F0F266123AE546D95AAE7FDBE0573156B8CEB40912E4144784B19
- SPKI SHA-256: 37DF9896E4C251AFC74D773AD10C635117812E94678809082B637CE03860996E
- Validity: 2020-07-28 to 2022-12-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://evrootocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:53:5a:ff:7f:fa:76:73:44:a8:5b:52:4a:d9:d0:29:7d:5d:ba:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
        Validity
            Not Before: Jul 28 09:34:35 2020 GMT
            Not After : Dec  6 00:00:00 2022 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/EVRootCA.cer
                OCSP - URI:http://evrootocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                FE:AB:00:90:98:9E:24:FC:A9:CC:1A:8A:FB:27:B8:BF:30:6E:A8:3B
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVRootLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FEF634033A8F0F266123AE546D95AAE7FDBE0573156B8CEB40912E4144784B19
    SPKI SHA256: 37DF9896E4C251AFC74D773AD10C635117812E94678809082B637CE03860996E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9
- AIA OCSP: http://evrootocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/EVRootCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Staat der Nederlanden Domein Server CA 2020

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Domein Server CA 2020
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA
- Serial: 5C099A347534A0AB11493B19D55A538AC6AC74B8
- SHA-256: 0DA914FB7125F6E644EB7AA261DE9EB809DC7F925B6B2A7D8A7EDD8736398B5B
- SPKI SHA-256: 37DF9896E4C251AFC74D773AD10C635117812E94678809082B637CE03860996E
- Validity: 2020-07-29 to 2022-12-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/DomeinServerCA2020LatestCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://evrootocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:09:9a:34:75:34:a0:ab:11:49:3b:19:d5:5a:53:8a:c6:ac:74:b8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
        Validity
            Not Before: Jul 29 17:26:24 2020 GMT
            Not After : Dec  6 00:00:00 2022 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Domein Server CA 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/EVRootCA.cer
                OCSP - URI:http://evrootocsp.pkioverheid.nl
            X509v3 Subject Key Identifier:
                5A:5D:34:25:C1:88:91:73:F9:DE:E1:0C:D5:F4:EA:18:BF:30:34:6E
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                FE:AB:00:90:98:9E:24:FC:A9:CC:1A:8A:FB:27:B8:BF:30:6E:A8:3B
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.8
                Policy: 2.16.528.1.1003.1.2.5.9
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVRootLatestCRL.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0DA914FB7125F6E644EB7AA261DE9EB809DC7F925B6B2A7D8A7EDD8736398B5B
    SPKI SHA256: 37DF9896E4C251AFC74D773AD10C635117812E94678809082B637CE03860996E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.16.528.1.1003.1.2.5.8, 2.16.528.1.1003.1.2.5.9, 2.23.140.1.2.2
- AIA OCSP: http://evrootocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/EVRootCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Staat der Nederlanden EV Intermediair CA

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA
- Serial: 98969A
- SHA-256: 6E73EB05E32843B568FE1AC7B9B0C9A6A2E945845F05B66D699E352B4BFA2F2E
- SPKI SHA-256: 176A861DC6B05292EB14CDC16A4BEFD472CDB12BA16770235AFC0593F7EC5254
- Validity: 2010-12-08 to 2022-12-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000026 (0x98969a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
        Validity
            Not Before: Dec  8 12:41:43 2010 GMT
            Not After : Dec  7 12:38:55 2022 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: http://www.logius.nl/producten/toegang/pkioverheid/documentatie/cps/
            X509v3 Subject Alternative Name:
                DirName:/CN=PKIo4096-1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                FE:AB:00:90:98:9E:24:FC:A9:CC:1A:8A:FB:27:B8:BF:30:6E:A8:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVRootLatestCRL.crl
            X509v3 Subject Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6E73EB05E32843B568FE1AC7B9B0C9A6A2E945845F05B66D699E352B4BFA2F2E
    SPKI SHA256: 176A861DC6B05292EB14CDC16A4BEFD472CDB12BA16770235AFC0593F7EC5254
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Staat der Nederlanden EV Intermediair CA

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Intermediair CA
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden EV Root CA
- Serial: 9898E8
- SHA-256: DC862A3F025EF7F252FA9413CB60DE25E57E6AA7E1FB1DCA7B59D2C2217106EA
- SPKI SHA-256: 176A861DC6B05292EB14CDC16A4BEFD472CDB12BA16770235AFC0593F7EC5254
- Validity: 2014-02-27 to 2022-12-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://evrootocsp.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000616 (0x9898e8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Root CA
        Validity
            Not Before: Feb 27 10:13:33 2014 GMT
            Not After : Dec  6 23:00:00 2022 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden EV Intermediair CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.7
                  CPS: https://cps.pkioverheid.nl
            X509v3 Subject Alternative Name:
                DirName:/CN=PKIo4096-1
            Authority Information Access:
                OCSP - URI:http://evrootocsp.pkioverheid.nl
                CA Issuers - URI:http://cert.pkioverheid.nl/EVRootCA.cer
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                FE:AB:00:90:98:9E:24:FC:A9:CC:1A:8A:FB:27:B8:BF:30:6E:A8:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/EVRootLatestCRL.crl
            X509v3 Subject Key Identifier:
                25:80:EB:D8:9F:A6:C3:11:41:37:C7:78:59:88:1E:69:EF:B1:D3:EA
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC862A3F025EF7F252FA9413CB60DE25E57E6AA7E1FB1DCA7B59D2C2217106EA
    SPKI SHA256: 176A861DC6B05292EB14CDC16A4BEFD472CDB12BA16770235AFC0593F7EC5254
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.7
- AIA OCSP: http://evrootocsp.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/EVRootCA.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/EVRootLatestCRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_directory_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Staat der Nederlanden Organisatie CA - G2

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G2
- Serial: 9896F4
- SHA-256: 85A8F5866DD78DF173B0667317C59B2D6242DE59EB01BB2F2E8B9DB714B4CA27
- SPKI SHA-256: 918ACD240893C88E254FFB8F43A28AFEC8BBD99F16F7FEDB18D0298714CE603E
- Validity: 2008-03-31 to 2020-03-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10000116 (0x9896f4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G2
        Validity
            Not Before: Mar 31 12:03:09 2008 GMT
            Not After : Mar 24 13:02:08 2020 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.pkioverheid.nl/policies/dom-org-policy-G2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                91:68:32:87:15:1D:89:E2:B5:F1:AC:36:28:34:8D:0B:7C:62:88:EB
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 85A8F5866DD78DF173B0667317C59B2D6242DE59EB01BB2F2E8B9DB714B4CA27
    SPKI SHA256: 918ACD240893C88E254FFB8F43A28AFEC8BBD99F16F7FEDB18D0298714CE603E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Staat der Nederlanden Organisatie Persoon CA - G3

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 98A246
- SHA-256: 8222BC4FE7A3DDCA9EF0BF0D682AC888799F87822D15332A54C0BFDFC6854F7B
- SPKI SHA-256: 03CB44B933D7E14551E52DDBFC335A4D57BF65A703667B57AC961DE31E3A106D
- Validity: 2013-11-14 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10003014 (0x98a246)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Nov 14 15:09:37 2013 GMT
            Not After : Nov 12 23:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8222BC4FE7A3DDCA9EF0BF0D682AC888799F87822D15332A54C0BFDFC6854F7B
    SPKI SHA256: 03CB44B933D7E14551E52DDBFC335A4D57BF65A703667B57AC961DE31E3A106D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_sub_ca_aia_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Staat der Nederlanden Organisatie Services CA - G3

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 98A23C
- SHA-256: D9581DBDE99B39EEFF6CE5C80DE1650DA0C1C8A109705ED286C53BC95E6655E4
- SPKI SHA-256: 5A804CCFF6C860C72D48F6796618DEFFF7A2935DD3781C8748AE335D8604B004
- Validity: 2013-11-14 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://rootocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 10003004 (0x98a23c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Nov 14 12:27:56 2013 GMT
            Not After : Nov 12 23:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                Policy: 2.16.528.1.1003.1.2.5.6
                  CPS: https://cps.pkioverheid.nl
            Authority Information Access:
                OCSP - URI:http://rootocsp-g3.pkioverheid.nl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D9581DBDE99B39EEFF6CE5C80DE1650DA0C1C8A109705ED286C53BC95E6655E4
    SPKI SHA256: 5A804CCFF6C860C72D48F6796618DEFFF7A2935DD3781C8748AE335D8604B004
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.6
- AIA OCSP: http://rootocsp-g3.pkioverheid.nl
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Staat der Nederlanden Organization Person CA - 2023

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organization Person CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 1C225B9ED283CC21B6FE6B2720AD90422B4D47A4
- SHA-256: BF45E3CE00CF22B8FC505BCA3875C6C85BC4FF5F2D9B439180829963307D8DC9
- SPKI SHA-256: 9AFBAD76D8B36A3C93E73723382777628EFAEBD3997124744FF378DEC96AD896
- Validity: 2023-10-31 to 2028-11-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Government of The Netherlands, PKIoverheid (Logius)
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.pkioverheid.nl/DomOrganizationPersonLatestCRL-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.10, 2.16.528.1.1003.1.2.5.11, 2.16.528.1.1003.1.2.5.12, 0.4.0.194112.1.2, 0.4.0.2042.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:22:5b:9e:d2:83:cc:21:b6:fe:6b:27:20:ad:90:42:2b:4d:47:a4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Oct 31 12:44:35 2023 GMT
            Not After : Nov 13 00:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organization Person CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/RootCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.10
                Policy: 2.16.528.1.1003.1.2.5.11
                Policy: 2.16.528.1.1003.1.2.5.12
                  CPS: https://cps.pkioverheid.nl
                Policy: 0.4.0.194112.1.2
                Policy: 0.4.0.2042.1.2
            X509v3 Extended Key Usage:
                1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                25:79:06:C6:A6:31:FD:DF:9E:71:A0:FE:4B:31:37:17:10:EE:46:BC
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BF45E3CE00CF22B8FC505BCA3875C6C85BC4FF5F2D9B439180829963307D8DC9
    SPKI SHA256: 9AFBAD76D8B36A3C93E73723382777628EFAEBD3997124744FF378DEC96AD896
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.10, 2.16.528.1.1003.1.2.5.11, 2.16.528.1.1003.1.2.5.12, 0.4.0.194112.1.2, 0.4.0.2042.1.2
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/RootCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Staat der Nederlanden Organization Services CA - 2023

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organization Services CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 55ADE748061827E8B9288B3C4E33583950939AE8
- SHA-256: 5352C1F494BCAC98E69C9C85D3D0418F7CED8C04874FD3C9FE7DBEBE7ADBE73D
- SPKI SHA-256: 5DC27F900851C08C395C6492DA0B7CD506560423072E97275DBEAD34BA79D9DA
- Validity: 2023-10-31 to 2028-11-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Government of The Netherlands, PKIoverheid (Logius)
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.pkioverheid.nl/DomOrganizationServicesLatestCRL-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.13, 2.16.528.1.1003.1.2.5.14, 2.16.528.1.1003.1.2.5.15, 0.4.0.194112.1.3, 0.4.0.2042.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:ad:e7:48:06:18:27:e8:b9:28:8b:3c:4e:33:58:39:50:93:9a:e8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Oct 31 12:26:17 2023 GMT
            Not After : Nov 13 00:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organization Services CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/RootCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.13
                Policy: 2.16.528.1.1003.1.2.5.14
                Policy: 2.16.528.1.1003.1.2.5.15
                  CPS: https://cps.pkioverheid.nl
                Policy: 0.4.0.194112.1.3
                Policy: 0.4.0.2042.1.2
            X509v3 Extended Key Usage:
                1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                18:F8:77:CD:90:EF:52:9F:5A:7C:3F:51:BE:12:08:AB:8E:4F:09:3F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5352C1F494BCAC98E69C9C85D3D0418F7CED8C04874FD3C9FE7DBEBE7ADBE73D
    SPKI SHA256: 5DC27F900851C08C395C6492DA0B7CD506560423072E97275DBEAD34BA79D9DA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.5.5.7.3.36, TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System
- Certificate Policies: 2.16.528.1.1003.1.2.5.13, 2.16.528.1.1003.1.2.5.14, 2.16.528.1.1003.1.2.5.15, 0.4.0.194112.1.3, 0.4.0.2042.1.2
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/RootCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Staat der Nederlanden S/MIME CA - 2023

- Subject: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden S/MIME CA - 2023
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Root CA - G3
- Serial: 6300FD22227D9C7C2F4366B5CF80E52F85E43EF7
- SHA-256: F0305F07AB78862F2F11E4DEFE6E5EB749F8686B54613355A4845DE2052C73DE
- SPKI SHA-256: 2FA7611FF5D19EF484F20AA9E093D75D22B7071E234A2B508E5DF687C0BB19B7
- Validity: 2023-10-31 to 2028-11-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crl.pkioverheid.nl/DomSMIMELatestCRL-2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.16.528.1.1003.1.2.10.9, 2.16.528.1.1003.1.2.11.9, 2.16.528.1.1003.1.2.12.9, 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:00:fd:22:22:7d:9c:7c:2f:43:66:b5:cf:80:e5:2f:85:e4:3e:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Root CA - G3
        Validity
            Not Before: Oct 31 13:07:13 2023 GMT
            Not After : Nov 13 00:00:00 2028 GMT
        Subject: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden S/MIME CA - 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                54:AD:FA:C7:92:57:AE:CA:35:9C:2E:12:FB:E4:BA:5D:20:DC:94:57
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/RootCA-G3.cer
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.10.9
                Policy: 2.16.528.1.1003.1.2.11.9
                Policy: 2.16.528.1.1003.1.2.12.9
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.3
                Policy: 2.23.140.1.5.4.3
                Policy: 0.4.0.2042.1.1
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
            X509v3 Subject Key Identifier:
                53:3C:B8:69:88:96:05:0A:41:73:93:29:CB:22:E2:AC:CD:1E:21:60
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F0305F07AB78862F2F11E4DEFE6E5EB749F8686B54613355A4845DE2052C73DE
    SPKI SHA256: 2FA7611FF5D19EF484F20AA9E093D75D22B7071E234A2B508E5DF687C0BB19B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.16.528.1.1003.1.2.10.9, 2.16.528.1.1003.1.2.11.9, 2.16.528.1.1003.1.2.12.9, 2.23.140.1.5.2.3, 2.23.140.1.5.3.3, 2.23.140.1.5.4.3, 0.4.0.2042.1.1
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/RootCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/RootLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### UZI-register Medewerker niet op naam CA G21

- Subject: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Medewerker niet op naam CA G21
- Issuer: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21
- Serial: E73C59A4F389B2BAE36E9C402CD84A7D
- SHA-256: C2BBB1C6893AC1BE05AA1F04F32428713171F18AB3E8F306A1CCCB031539E869
- SPKI SHA-256: 89979EFE49FB8D10B055DF52BC12BD2310C556C91968F103BA0013AD5640F386
- Validity: 2010-03-18 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e7:3c:59:a4:f3:89:b2:ba:e3:6e:9c:40:2c:d8:4a:7d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = Zorg CSP CA G21
        Validity
            Not Before: Mar 18 10:51:13 2010 GMT
            Not After : Mar 22 09:40:00 2020 GMT
        Subject: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = UZI-register Medewerker niet op naam CA G21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.csp.uzi-register.nl/cps/cps.html
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EF:B3:EB:B1:8B:D0:04:AF:81:28:C6:5B:5C:23:31:9A:C1:B8:28:90
            X509v3 Authority Key Identifier:
                54:9B:BA:59:2C:48:03:D1:68:89:5B:F6:CA:4B:F1:00:EC:38:59:DE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C2BBB1C6893AC1BE05AA1F04F32428713171F18AB3E8F306A1CCCB031539E869
    SPKI SHA256: 89979EFE49FB8D10B055DF52BC12BD2310C556C91968F103BA0013AD5640F386
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### UZI-register Medewerker niet op naam CA G3

- Subject: countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker niet op naam CA G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 5CE40505B5FC2352
- SHA-256: 38DED3FF6827579008AF4887EB9698A3CFA927FA8ED59F06BA090FB9A63E2D77
- SPKI SHA-256: 8A8EF49BE57FE7D0F76A954BDF464B0F80508C602135498CD9C2D2F9B7BCB7FB
- Validity: 2017-05-09 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.csp.uzi-register.nl/cdp/uzi-register_medewerker_niet_op_naam_ca_g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6693480468265575250 (0x5ce40505b5fc2352)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: May  9 08:26:19 2017 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = CIBG, organizationIdentifier = NTRNL-50000535, CN = UZI-register Medewerker niet op naam CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                43:EE:35:BF:67:74:3F:9F:CC:65:15:E2:D9:C5:57:25:D8:41:88:D2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                Policy: 2.16.528.1.1003.1.2.5.5
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.7
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 38DED3FF6827579008AF4887EB9698A3CFA927FA8ED59F06BA090FB9A63E2D77
    SPKI SHA256: 8A8EF49BE57FE7D0F76A954BDF464B0F80508C602135498CD9C2D2F9B7BCB7FB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5, 2.16.528.1.1003.1.2.5.7
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UZI-register Medewerker niet op naam CA G3

- Subject: countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker niet op naam CA G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Services CA - G3
- Serial: 24CB50555470EB7995C7A9758D8C42BD242AF0D8
- SHA-256: 972957304031234ED17679FDCB97556D6173D5F2BF0E6E66D612680CA6E77685
- SPKI SHA-256: 8A8EF49BE57FE7D0F76A954BDF464B0F80508C602135498CD9C2D2F9B7BCB7FB
- Validity: 2019-04-18 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.csp.uzi-register.nl/cdp/uzi-register_medewerker_niet_op_naam_ca_g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:cb:50:55:54:70:eb:79:95:c7:a9:75:8d:8c:42:bd:24:2a:f0:d8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Services CA - G3
        Validity
            Not Before: Apr 18 09:12:58 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = CIBG, organizationIdentifier = NTRNL-50000535, CN = UZI-register Medewerker niet op naam CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
                OCSP - URI:http://domorganisatieservicesocsp-g3.pkioverheid.nl
            X509v3 Subject Key Identifier:
                43:EE:35:BF:67:74:3F:9F:CC:65:15:E2:D9:C5:57:25:D8:41:88:D2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                43:EB:4D:00:D3:95:93:CE:A6:7C:40:0D:6D:11:BE:39:D1:32:AE:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.4
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 972957304031234ED17679FDCB97556D6173D5F2BF0E6E66D612680CA6E77685
    SPKI SHA256: 8A8EF49BE57FE7D0F76A954BDF464B0F80508C602135498CD9C2D2F9B7BCB7FB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.4, 2.16.528.1.1003.1.2.5.5
- AIA OCSP: http://domorganisatieservicesocsp-g3.pkioverheid.nl
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatieServicesCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieServicesLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UZI-register Medewerker op naam CA G21

- Subject: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Medewerker op naam CA G21
- Issuer: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21
- Serial: 950AC809F0FDD2A94712D38C5BCE427E
- SHA-256: BEB79B655740B901E688835458391B53F606341DE76D2FBBAF3E0807CDA50A4D
- SPKI SHA-256: CC3B71D8CABD30C5DF1376DBC7186A1906E2B4B4EE422750CBE20D4258968295
- Validity: 2010-03-18 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            95:0a:c8:09:f0:fd:d2:a9:47:12:d3:8c:5b:ce:42:7e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = Zorg CSP CA G21
        Validity
            Not Before: Mar 18 10:40:46 2010 GMT
            Not After : Mar 22 09:40:00 2020 GMT
        Subject: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = UZI-register Medewerker op naam CA G21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.csp.uzi-register.nl/cps/cps.html
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C4:C4:6B:95:DC:57:21:F0:6C:B8:FA:72:C1:3D:C8:BD:AB:AB:3C:61
            X509v3 Authority Key Identifier:
                54:9B:BA:59:2C:48:03:D1:68:89:5B:F6:CA:4B:F1:00:EC:38:59:DE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BEB79B655740B901E688835458391B53F606341DE76D2FBBAF3E0807CDA50A4D
    SPKI SHA256: CC3B71D8CABD30C5DF1376DBC7186A1906E2B4B4EE422750CBE20D4258968295
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### UZI-register Medewerker op naam CA G3

- Subject: countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker op naam CA G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 1D857D9EB996200B
- SHA-256: D8553A2880E96B7AA4C7413DD903AFD3D580504695DD26A168FD48CCE7B1474A
- SPKI SHA-256: 742CABC402942BC8F946840921293F40F43D796875C2F0D9163909C6FCAC6353
- Validity: 2017-05-09 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.csp.uzi-register.nl/cdp/uzi-register_medewerker_op_naam_ca_g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2127244519674355723 (0x1d857d9eb996200b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: May  9 08:47:01 2017 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = CIBG, organizationIdentifier = NTRNL-50000535, CN = UZI-register Medewerker op naam CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                A0:D2:4D:07:E7:34:A6:4A:5A:4B:09:AB:D4:58:1B:ED:49:1B:81:D4
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D8553A2880E96B7AA4C7413DD903AFD3D580504695DD26A168FD48CCE7B1474A
    SPKI SHA256: 742CABC402942BC8F946840921293F40F43D796875C2F0D9163909C6FCAC6353
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### UZI-register Medewerker op naam CA G3

- Subject: countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Medewerker op naam CA G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 24EF1EED6FF448F94AD2D196BDD3D164DCCAF89B
- SHA-256: D28DB435E31212A3BDCCF87620F6544B99A9C02328BF983E882FD0627A1D130F
- SPKI SHA-256: 742CABC402942BC8F946840921293F40F43D796875C2F0D9163909C6FCAC6353
- Validity: 2019-04-18 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.csp.uzi-register.nl/cdp/uzi-register_medewerker_op_naam_ca_g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:ef:1e:ed:6f:f4:48:f9:4a:d2:d1:96:bd:d3:d1:64:dc:ca:f8:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Apr 18 08:15:14 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = CIBG, organizationIdentifier = NTRNL-50000535, CN = UZI-register Medewerker op naam CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                A0:D2:4D:07:E7:34:A6:4A:5A:4B:09:AB:D4:58:1B:ED:49:1B:81:D4
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D28DB435E31212A3BDCCF87620F6544B99A9C02328BF983E882FD0627A1D130F
    SPKI SHA256: 742CABC402942BC8F946840921293F40F43D796875C2F0D9163909C6FCAC6353
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### UZI-register Server CA G21

- Subject: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Server CA G21
- Issuer: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21
- Serial: B9255FC3E5796EEAB69508B9A40D3763
- SHA-256: E78D72822E785D20F8C51B4780FEFA87993692EF4556CCAA58FDD0E34E5E7F0C
- SPKI SHA-256: 80779E1ED84005E303B1D64BC525611CD013DEF2CDAABEDFED2ACEB28C15F5A1
- Validity: 2010-03-18 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b9:25:5f:c3:e5:79:6e:ea:b6:95:08:b9:a4:0d:37:63
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = Zorg CSP CA G21
        Validity
            Not Before: Mar 18 11:02:42 2010 GMT
            Not After : Mar 22 09:40:00 2020 GMT
        Subject: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = UZI-register Server CA G21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.csp.uzi-register.nl/cps/cps.html
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                14:D9:A5:1E:9C:49:CE:D2:C9:01:26:88:BC:B5:C5:3E:30:FC:7C:FC
            X509v3 Authority Key Identifier:
                54:9B:BA:59:2C:48:03:D1:68:89:5B:F6:CA:4B:F1:00:EC:38:59:DE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E78D72822E785D20F8C51B4780FEFA87993692EF4556CCAA58FDD0E34E5E7F0C
    SPKI SHA256: 80779E1ED84005E303B1D64BC525611CD013DEF2CDAABEDFED2ACEB28C15F5A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### UZI-register Zorgverlener CA G21

- Subject: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=UZI-register Zorgverlener CA G21
- Issuer: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21
- Serial: A13186A4B80E0148F444D8C8DFDBD222
- SHA-256: 2D1703A4626AF0CD6229E3D3776B610AB4E53FA8FE0DEB3D67B963B266661268
- SPKI SHA-256: 72EEB1AD9A5CFE210829F3A301005593428BB7321F0E8149849630D103FA998D
- Validity: 2010-03-18 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a1:31:86:a4:b8:0e:01:48:f4:44:d8:c8:df:db:d2:22
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = Zorg CSP CA G21
        Validity
            Not Before: Mar 18 10:15:28 2010 GMT
            Not After : Mar 22 09:40:00 2020 GMT
        Subject: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = UZI-register Zorgverlener CA G21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.csp.uzi-register.nl/cps/cps.html
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                60:F1:ED:CD:4B:3F:7E:9A:43:D1:FA:32:A0:07:ED:D6:A4:89:D3:D3
            X509v3 Authority Key Identifier:
                54:9B:BA:59:2C:48:03:D1:68:89:5B:F6:CA:4B:F1:00:EC:38:59:DE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2D1703A4626AF0CD6229E3D3776B610AB4E53FA8FE0DEB3D67B963B266661268
    SPKI SHA256: 72EEB1AD9A5CFE210829F3A301005593428BB7321F0E8149849630D103FA998D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### UZI-register Zorgverlener CA G3

- Subject: countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Zorgverlener CA G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 22216A9429EA5234
- SHA-256: 3EAD4F72F06F1054881D2728DE033A8E13FADE6BD165084018EB943C17378DAA
- SPKI SHA-256: 2C96E4B43A544ED405C62C7E4C7E0F89D4C62EBB75486C566544D62BC4829FD4
- Validity: 2017-05-09 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.csp.uzi-register.nl/cdp/uzi-register_zorgverlener_ca_g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2459364056111927860 (0x22216a9429ea5234)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: May  9 09:32:59 2017 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = CIBG, organizationIdentifier = NTRNL-50000535, CN = UZI-register Zorgverlener CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                C4:FC:77:D5:08:48:98:12:87:B7:F6:51:13:C5:CB:AE:FB:35:83:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                Policy: 2.16.528.1.1003.1.2.5.3
                  CPS: https://cps.pkioverheid.nl
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3EAD4F72F06F1054881D2728DE033A8E13FADE6BD165084018EB943C17378DAA
    SPKI SHA256: 2C96E4B43A544ED405C62C7E4C7E0F89D4C62EBB75486C566544D62BC4829FD4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### UZI-register Zorgverlener CA G3

- Subject: countryName=NL, organizationName=CIBG, organizationIdentifier=NTRNL-50000535, commonName=UZI-register Zorgverlener CA G3
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie Persoon CA - G3
- Serial: 61B6FD9D33FEAA70F02E27FB98B76F8282BA4128
- SHA-256: 507DB60D263D3D09D283DE2E3AA435DFD8775E52BC335702E3832BBB57EC1CBD
- SPKI SHA-256: 2C96E4B43A544ED405C62C7E4C7E0F89D4C62EBB75486C566544D62BC4829FD4
- Validity: 2019-04-18 to 2028-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://cp.pkioverheid.nl/pkioverheid-por-v5.2.pdf, https://www.zorgcsp.nl/documents/20251111%20CPS%20UZI-register%20V12.1%20ENG.pdf
- CP/CPS same as parent: false
- Audit URLs: https://verifeyedirectoryprod.blob.core.windows.net/pas7000docs/cibg__-0047206672-000/ets_039.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.csp.uzi-register.nl/cdp/uzi-register_zorgverlener_ca_g3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:b6:fd:9d:33:fe:aa:70:f0:2e:27:fb:98:b7:6f:82:82:ba:41:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie Persoon CA - G3
        Validity
            Not Before: Apr 18 08:33:53 2019 GMT
            Not After : Nov 12 00:00:00 2028 GMT
        Subject: C = NL, O = CIBG, organizationIdentifier = NTRNL-50000535, CN = UZI-register Zorgverlener CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
            X509v3 Subject Key Identifier:
                C4:FC:77:D5:08:48:98:12:87:B7:F6:51:13:C5:CB:AE:FB:35:83:4A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                EE:AC:6D:40:EA:D5:04:6A:87:2C:55:7B:F5:3F:2D:DA:EE:DB:AC:E2
            qcStatements:
                0.0...+.......0.......I..
            X509v3 Certificate Policies:
                Policy: 2.16.528.1.1003.1.2.5.1
                Policy: 2.16.528.1.1003.1.2.5.2
                  CPS: https://cps.pkioverheid.nl
                Policy: 2.16.528.1.1003.1.2.5.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 507DB60D263D3D09D283DE2E3AA435DFD8775E52BC335702E3832BBB57EC1CBD
    SPKI SHA256: 2C96E4B43A544ED405C62C7E4C7E0F89D4C62EBB75486C566544D62BC4829FD4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, Microsoft Encrypted File System, OCSP Signing
- Certificate Policies: 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
- AIA OCSP: -
- AIA CA Issuers: http://cert.pkioverheid.nl/DomOrganisatiePersoonCA-G3.cer
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatiePersoonLatestCRL-G3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Zorg CSP CA G21

- Subject: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21
- Issuer: countryName=NL, organizationName=Staat der Nederlanden, commonName=Staat der Nederlanden Organisatie CA - G2
- Serial: 0131345B
- SHA-256: 7AA7163D2D77A62284F3066C8DAF6E1E745C5F7EAE1585BE13F8748856E72809
- SPKI SHA-256: 47F602A6D1405EAC9B437EA078232E673E3BFE543D95F6F2033CC8ECCF24F369
- Validity: 2010-03-16 to 2020-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: CIBG, Uitvoeringsorganisatie van het  Ministerie van Volksgezondheid, Welzijn  en Sport
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.zorgcsp.nl/Media/Default/documenten/English%20version%20(UZI-register).pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=9114853
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 20001883 (0x131345b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = Staat der Nederlanden, CN = Staat der Nederlanden Organisatie CA - G2
        Validity
            Not Before: Mar 16 09:42:19 2010 GMT
            Not After : Mar 23 09:40:03 2020 GMT
        Subject: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = Zorg CSP CA G21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.csp.uzi-register.nl/cps/cps.html
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                keyid:39:10:8B:49:92:5C:DB:61:12:20:CD:49:9D:1A:8E:DA:9C:67:40:B9
                DirName:/C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G2
                serial:98:96:F4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
            X509v3 Subject Key Identifier:
                54:9B:BA:59:2C:48:03:D1:68:89:5B:F6:CA:4B:F1:00:EC:38:59:DE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7AA7163D2D77A62284F3066C8DAF6E1E745C5F7EAE1585BE13F8748856E72809
    SPKI SHA256: 47F602A6D1405EAC9B437EA078232E673E3BFE543D95F6F2033CC8ECCF24F369
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### ZOVAR Server CA G21

- Subject: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=ZOVAR Server CA G21
- Issuer: countryName=NL, organizationName=agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, commonName=Zorg CSP CA G21
- Serial: 11F7FD15D5D338C66BD5F2664AB4D0C5
- SHA-256: D340C646C965227DE279E7F22393D2412CB6DBA0513B8AFAF56387AEF997BB42
- SPKI SHA-256: 7765B76B541E3AEFB572AC5A8D835729067229C53E163735D2DDCFC92F75C84C
- Validity: 2010-03-18 to 2020-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.logius.nl/languages/english/pkioverheid/, https://www.zorgcsp.nl/Media/Default/documenten/RK1.CPS%20ZOVAR%20v3%201%20definitief.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:f7:fd:15:d5:d3:38:c6:6b:d5:f2:66:4a:b4:d0:c5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = Zorg CSP CA G21
        Validity
            Not Before: Mar 18 11:16:33 2010 GMT
            Not After : Mar 22 09:40:00 2020 GMT
        Subject: C = NL, O = agentschap Centraal Informatiepunt Beroepen Gezondheidszorg, CN = ZOVAR Server CA G21
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.csp.zovar.nl/cps/cps.html
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FC:E7:F1:13:FD:D2:07:3F:F5:B3:AC:2D:96:B1:5A:D8:A3:04:E8:68
            X509v3 Authority Key Identifier:
                54:9B:BA:59:2C:48:03:D1:68:89:5B:F6:CA:4B:F1:00:EC:38:59:DE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D340C646C965227DE279E7F22393D2412CB6DBA0513B8AFAF56387AEF997BB42
    SPKI SHA256: 7765B76B541E3AEFB572AC5A8D835729067229C53E163735D2DDCFC92F75C84C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired
