# CA Owner Audit Dump - Microsoft Corporation

Generated: 2026-07-28T07:33:56.525267Z

## CA Owner Summary

- Name: Microsoft Corporation
- Country: United States of America
- Website: -
- Problem Reporting: https://www.microsoft.com/pkiops/docs/repository.htm
- CP/CPS URLs: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_CP_v3.2.0.pdf, https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_public_tls_CPS_v3.3.6.pdf, https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_ThirdParty_CPS_v1.0.5.pdf, https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CP_v2.1.pdf, https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CPS_v2.1.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28efc2e1-0a2a-48c8-9ec0-5343118da987, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=dc446edf-d5ff-4fdd-b35a-853136236051, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0436398e-8a3b-42d4-84c8-f15b4149087c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=70ae9251-8e87-4ce4-963c-b712e66ee502, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=741b964d-cb23-42ea-a083-127b322a9f4f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7c20c02c-f0b0-4363-ae9a-8ab4a7616da1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=54741c3e-0fb2-4a81-a30f-4d21780ce1f8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28234a18-b64b-429d-b3ce-179c9512dbe1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=afa8cdc0-5a66-43a7-aed7-34ade9000c6c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=40dcb320-db79-46c3-a381-c134a6095da3, https://cert.webtrust.org/SealFile?seal=2081&file=pdf
- Root Programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://www.microsoft.com/pkiops/docs/repository.htm
- CP/CPS URLs: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_CP_v3.2.0.pdf, https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_public_tls_CPS_v3.3.6.pdf, https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_ThirdParty_CPS_v1.0.5.pdf, https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CP_v2.1.pdf, https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CPS_v2.1.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28efc2e1-0a2a-48c8-9ec0-5343118da987, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=dc446edf-d5ff-4fdd-b35a-853136236051, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0436398e-8a3b-42d4-84c8-f15b4149087c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=70ae9251-8e87-4ce4-963c-b712e66ee502, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=741b964d-cb23-42ea-a083-127b322a9f4f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7c20c02c-f0b0-4363-ae9a-8ab4a7616da1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=54741c3e-0fb2-4a81-a30f-4d21780ce1f8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28234a18-b64b-429d-b3ce-179c9512dbe1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=afa8cdc0-5a66-43a7-aed7-34ade9000c6c, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=40dcb320-db79-46c3-a381-c134a6095da3, https://cert.webtrust.org/SealFile?seal=2081&file=pdf
- Repository URLs: https://www.microsoft.com/pkiops/docs/repository.htm
- Root programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=US, organizationName=MSFT, commonName=Microsoft Authenticode(tm) Root Authority | yes | expired | 1995-01-01 to 1999-12-31 | - | - | - | historical errors: 1 |
| 2 | organizationName=Microsoft Trust Network, organizationalUnitName=Microsoft Corporation, organizationalUnitName=Microsoft Time Stamping Service Root, organizationalUnitName=Copyright (c) 1997 Microsoft Corp. | yes | expired | 1997-05-13 to 1999-12-30 | - | - | - | historical errors: 1 |
| 3 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017 | yes | unknown | 2019-12-18 to 2042-07-18 | - | - | - | clean |
| 4 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017 | yes | unknown | 2017-07-26 to 2042-07-26 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | current errors: 1 |
| 5 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017 | yes | unknown | 2017-07-26 to 2042-07-26 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | current errors: 1 |
| 6 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017 | yes | unknown | 2019-12-18 to 2042-07-18 | - | - | - | clean |
| 7 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017 | yes | unknown | 2017-07-26 to 2042-07-26 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | current errors: 1 |
| 8 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017 | yes | unknown | 2019-12-18 to 2042-07-18 | - | - | - | clean |
| 9 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Identity Verification Root Certificate Authority 2020 | yes | unknown | 2020-04-16 to 2045-04-16 | - | - | - | clean |
| 10 | organizationalUnitName=Copyright (c) 1997 Microsoft Corp., organizationalUnitName=Microsoft Corporation, commonName=Microsoft Root Authority | yes | expired | 1997-01-10 to 2020-12-31 | - | - | - | historical errors: 1 |
| 11 | domainComponent=com, domainComponent=microsoft, commonName=Microsoft Root Certificate Authority | yes | expired | 2001-05-09 to 2021-05-09 | - | - | - | historical errors: 2 |
| 12 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017 | yes | unknown | 2017-07-26 to 2042-07-26 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | current errors: 1 |
| 13 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017 | yes | unknown | 2019-12-18 to 2042-07-18 | - | - | - | clean |
| 14 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2 | yes | unknown | 2025-04-10 to 2040-04-10 | - | - | - | current errors: 1 |
| 15 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2 | yes | unknown | 2025-04-10 to 2040-04-10 | - | - | - | clean |
| 16 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 01 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 17 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure ECC TLS Issuing CA 01 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 18 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 02 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 19 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure ECC TLS Issuing CA 02 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 20 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 03 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 21 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 04 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 22 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure ECC TLS Issuing CA 05 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 23 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 05 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 24 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure ECC TLS Issuing CA 06 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 25 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 06 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 26 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 07 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 27 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 08 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 28 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 03 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 29 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 04 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 30 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 07 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 31 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 08 | yes | current | 2023-05-25 to 2028-05-25 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 32 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure TLS Issuing CA 01 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 33 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 01 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 34 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure TLS Issuing CA 02 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 35 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 02 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 36 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure TLS Issuing CA 05 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 37 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 05 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 38 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure TLS Issuing CA 06 | yes | revoked, expired | 2019-06-27 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 39 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 06 | yes | expired | 2020-01-17 to 2024-06-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 40 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Server PCA 2018 | yes | revoked | 2018-02-28 to 2033-02-28 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | clean |
| 41 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 01 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 42 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 01 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 43 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 02 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 44 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 02 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 45 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 01 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 46 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 01 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 47 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 02 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 48 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 02 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 49 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Server PCA 2018 | yes | revoked | 2018-02-28 to 2033-02-28 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | clean |
| 50 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV Server PCA 2018 | yes | revoked | 2018-02-28 to 2033-02-28 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | clean |
| 51 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 01 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 52 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 01 | yes | revoked, expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 8 |
| 53 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 01 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 54 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 02 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 55 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 02 | yes | revoked, expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 8 |
| 56 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 02 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 57 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 01 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 58 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 01 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 59 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 01 | yes | revoked, expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 8 |
| 60 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 02 | yes | revoked, expired | 2021-03-11 to 2026-03-11 | - | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 61 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 02 | yes | expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 62 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 02 | yes | revoked, expired | 2021-06-24 to 2026-06-24 | 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 8 |
| 63 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft Server PCA 2018 | yes | revoked | 2018-02-28 to 2033-02-28 | 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1 | - | - | clean |
| 64 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC EV Issuing CA 01 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 65 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC EV Issuing CA 02 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 66 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC EV Issuing CA 02 | yes | revoked, expired | 2019-06-11 to 2024-06-11 | 2.5.29.32.0 | 0 | - | clean |
| 67 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC EV Issuing CA 02 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 68 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 05 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 69 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 06 | yes | revoked, expired | 2019-06-11 to 2024-06-11 | 2.5.29.32.0 | 0 | - | clean |
| 70 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 06 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 71 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 06 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 72 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Issuing CA 01 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 73 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC Issuing CA 02 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 74 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC Issuing CA 02 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 75 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC Issuing CA 05 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 76 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC Issuing CA 06 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 77 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC Issuing CA 06 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 78 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS EV Issuing CA 01 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 79 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS EV Issuing CA 02 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 80 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS EV Issuing CA 02 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 81 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS EV Issuing CA 05 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 82 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS EV Issuing CA 06 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 83 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS EV Issuing CA 06 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 84 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 ECC CA 01 | yes | current | 2025-08-28 to 2030-08-28 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 85 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 ECC CA 02 | yes | current | 2025-08-28 to 2030-08-28 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 86 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 01 | yes | current | 2025-08-28 to 2030-08-28 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 87 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 02 | yes | current | 2025-08-28 to 2030-08-28 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 88 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 03 | yes | current | 2025-08-28 to 2030-08-28 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 89 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 04 | yes | current | 2025-08-28 to 2030-08-28 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 90 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 02 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 91 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 04 | yes | current | 2025-08-14 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 92 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 06 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 93 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 08 | yes | current | 2025-08-14 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 94 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 02 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 95 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 02 | yes | revoked | 2025-06-26 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 96 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 04 | yes | revoked | 2025-06-26 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 97 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 04 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 98 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 06 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 99 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 06 | yes | revoked | 2025-06-26 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 100 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 08 | yes | current | 2025-08-14 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 101 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 10 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 102 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 10 | yes | revoked | 2025-06-26 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 103 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 12 | yes | current | 2025-08-14 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 104 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 14 | yes | current | 2025-08-14 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 105 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 16 | yes | current | 2025-08-01 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 106 | countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 16 | yes | revoked | 2025-06-26 to 2029-06-03 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 107 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS Issuing CA 01 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 108 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 02 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 109 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 02 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 110 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 03 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 111 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 03 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 112 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 05 | yes | revoked, expired | 2018-05-31 to 2023-05-31 | 2.5.29.32.0 | 0 | - | clean |
| 113 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 06 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 114 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 06 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 115 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 07 | yes | revoked, expired | 2019-05-14 to 2024-05-14 | 2.5.29.32.0 | 0 | - | clean |
| 116 | countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 07 | yes | revoked, expired | 2019-07-25 to 2024-05-14 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |

## Certificate Details

### Microsoft Authenticode(tm) Root Authority

- Subject: countryName=US, organizationName=MSFT, commonName=Microsoft Authenticode(tm) Root Authority
- Issuer: countryName=US, organizationName=MSFT, commonName=Microsoft Authenticode(tm) Root Authority
- Serial: 01
- SHA-256: 4898B1749717A594A2030F47C83C272BD14BAE3DCEB2EAE382174EF2EC1C75C9
- SPKI SHA-256: 85C4C9D96AA2B0003C7FF0EA1ECF61C1122054513D7C8BB6634449C9CAAC328D
- Validity: 1995-01-01 to 1999-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-MD5

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C = US, O = MSFT, CN = Microsoft Authenticode(tm) Root Authority
        Validity
            Not Before: Jan  1 08:00:01 1995 GMT
            Not After : Dec 31 23:59:59 1999 GMT
        Subject: C = US, O = MSFT, CN = Microsoft Authenticode(tm) Root Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            2.5.29.10:
                0.....
            commonName:
                .)Microsoft Authenticode(tm) Root Authority
            2.5.29.1:
                0i.....[...*.9..b.S2.R0P1.0...U....US1
0...U.
..MSFT1200..U...)Microsoft Authenticode(tm) Root Authority...
    Signature Algorithm: md5WithRSAEncryption
    SHA256 Fingerprint: 4898B1749717A594A2030F47C83C272BD14BAE3DCEB2EAE382174EF2EC1C75C9
    SPKI SHA256: 85C4C9D96AA2B0003C7FF0EA1ECF61C1122054513D7C8BB6634449C9CAAC328D
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_signature_algorithm_not_supported: 

#### Computed Flags

- is_root_ca
- is_self_signed
- is_ca
- is_expired

### Microsoft Corporation

- Subject: organizationName=Microsoft Trust Network, organizationalUnitName=Microsoft Corporation, organizationalUnitName=Microsoft Time Stamping Service Root, organizationalUnitName=Copyright (c) 1997 Microsoft Corp.
- Issuer: organizationName=Microsoft Trust Network, organizationalUnitName=Microsoft Corporation, organizationalUnitName=Microsoft Time Stamping Service Root, organizationalUnitName=Copyright (c) 1997 Microsoft Corp.
- Serial: 01
- SHA-256: 6EF914723F089D2ADAFF98D470A3651CCF1768E559FBDCC0FAAA640AA12E5753
- SPKI SHA-256: BCEF9B00252EFF869B53E57B18835370EEAAC30035DE561AACE1FDE70F7EAF08
- Validity: 1997-05-13 to 1999-12-30
- Key: RSA 1024
- Signature Algorithm: RSA-MD5

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 1 (0x1)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: O = Microsoft Trust Network, OU = Microsoft Corporation, OU = Microsoft Time Stamping Service Root, OU = Copyright (c) 1997 Microsoft Corp.
        Validity
            Not Before: May 13 16:12:59 1997 GMT
            Not After : Dec 30 23:59:59 1999 GMT
        Subject: O = Microsoft Trust Network, OU = Microsoft Corporation, OU = Microsoft Time Stamping Service Root, OU = Copyright (c) 1997 Microsoft Corp.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Exponent: 65537 (0x10001)
    Signature Algorithm: md5WithRSAEncryption
    SHA256 Fingerprint: 6EF914723F089D2ADAFF98D470A3651CCF1768E559FBDCC0FAAA640AA12E5753
    SPKI SHA256: BCEF9B00252EFF869B53E57B18835370EEAAC30035DE561AACE1FDE70F7EAF08
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_signature_algorithm_not_supported: 

#### Computed Flags

- is_root_ca
- is_self_signed
- is_ca
- is_expired

### Microsoft ECC Root Certificate Authority 2017

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 66F23DAF87DE8BB14AEA0C573101C2EC
- SHA-256: 358DF39D764AF9E1B766E9C972DF352EE15CFAC227AF6AD1D70E8E4A6EDCBA02
- SPKI SHA-256: 35F53CE1264611E03340FE37E1EC7D4CC986C5613DCA70FD04AA44545F2DAF28
- Validity: 2019-12-18 to 2042-07-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_CP_v3.2.0.pdf, https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_public_tls_CPS_v3.3.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28efc2e1-0a2a-48c8-9ec0-5343118da987, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=dc446edf-d5ff-4fdd-b35a-853136236051, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0436398e-8a3b-42d4-84c8-f15b4149087c
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:f2:3d:af:87:de:8b:b1:4a:ea:0c:57:31:01:c2:ec
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Dec 18 23:06:45 2019 GMT
            Not After : Jul 18 23:16:04 2042 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 358DF39D764AF9E1B766E9C972DF352EE15CFAC227AF6AD1D70E8E4A6EDCBA02
    SPKI SHA256: 35F53CE1264611E03340FE37E1EC7D4CC986C5613DCA70FD04AA44545F2DAF28
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft ECC Root Certificate Authority 2017

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 71767E8D58E4FC9649C63EFBCF3ABDA7
- SHA-256: FEA1884AB3AEA6D0DBEDBE4B9CD9FEC8655116300A86A856488FC488BB4B44D2
- SPKI SHA-256: 35F53CE1264611E03340FE37E1EC7D4CC986C5613DCA70FD04AA44545F2DAF28
- Validity: 2017-07-26 to 2042-07-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=70ae9251-8e87-4ce4-963c-b712e66ee502, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=741b964d-cb23-42ea-a083-127b322a9f4f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7c20c02c-f0b0-4363-ae9a-8ab4a7616da1
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:76:7e:8d:58:e4:fc:96:49:c6:3e:fb:cf:3a:bd:a7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jul 26 22:22:53 2017 GMT
            Not After : Jul 26 22:31:47 2042 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FEA1884AB3AEA6D0DBEDBE4B9CD9FEC8655116300A86A856488FC488BB4B44D2
    SPKI SHA256: 35F53CE1264611E03340FE37E1EC7D4CC986C5613DCA70FD04AA44545F2DAF28
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_root_ca_contains_cert_policy: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Microsoft EV ECC Root Certificate Authority 2017

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 3FDCCC3B5BDCD29844CADF59D1D2EB1C
- SHA-256: 6AEA30BC02CA85AFCFEC2F65F60881893C926925FD0704BD8ADA3F0F6EDDB699
- SPKI SHA-256: F26CDAA1C48E2D369EAF24993A424F8290983AF7094A5BDE9C7D44341F2E2428
- Validity: 2017-07-26 to 2042-07-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=70ae9251-8e87-4ce4-963c-b712e66ee502, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=741b964d-cb23-42ea-a083-127b322a9f4f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7c20c02c-f0b0-4363-ae9a-8ab4a7616da1
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:dc:cc:3b:5b:dc:d2:98:44:ca:df:59:d1:d2:eb:1c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Jul 26 21:57:45 2017 GMT
            Not After : Jul 26 22:05:36 2042 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6AEA30BC02CA85AFCFEC2F65F60881893C926925FD0704BD8ADA3F0F6EDDB699
    SPKI SHA256: F26CDAA1C48E2D369EAF24993A424F8290983AF7094A5BDE9C7D44341F2E2428
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_root_ca_contains_cert_policy: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Microsoft EV ECC Root Certificate Authority 2017

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 22AF4E52C260579B449C1DDE01C8E319
- SHA-256: DE1AF143FFA160CF5FA86ABFE577291633DC264DA12C863C5738BEA4AFBB2CDB
- SPKI SHA-256: F26CDAA1C48E2D369EAF24993A424F8290983AF7094A5BDE9C7D44341F2E2428
- Validity: 2019-12-18 to 2042-07-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=54741c3e-0fb2-4a81-a30f-4d21780ce1f8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28234a18-b64b-429d-b3ce-179c9512dbe1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=afa8cdc0-5a66-43a7-aed7-34ade9000c6c
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:af:4e:52:c2:60:57:9b:44:9c:1d:de:01:c8:e3:19
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Dec 18 22:22:16 2019 GMT
            Not After : Jul 18 22:31:43 2042 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DE1AF143FFA160CF5FA86ABFE577291633DC264DA12C863C5738BEA4AFBB2CDB
    SPKI SHA256: F26CDAA1C48E2D369EAF24993A424F8290983AF7094A5BDE9C7D44341F2E2428
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft EV RSA Root Certificate Authority 2017

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 19FCEB6DF7CF57844184BDD9E0228E98
- SHA-256: DFB3C314740596AD5FB97960EF62AD7C1FCCEEAD16E74054652D1032E6F140EF
- SPKI SHA-256: 68AA635451D83962167E88FB08F8678D73AEC66FC559462137CFF9D1BC3D3871
- Validity: 2017-07-26 to 2042-07-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=70ae9251-8e87-4ce4-963c-b712e66ee502, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=741b964d-cb23-42ea-a083-127b322a9f4f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7c20c02c-f0b0-4363-ae9a-8ab4a7616da1
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:fc:eb:6d:f7:cf:57:84:41:84:bd:d9:e0:22:8e:98
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 26 21:41:53 2017 GMT
            Not After : Jul 26 21:47:58 2042 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DFB3C314740596AD5FB97960EF62AD7C1FCCEEAD16E74054652D1032E6F140EF
    SPKI SHA256: 68AA635451D83962167E88FB08F8678D73AEC66FC559462137CFF9D1BC3D3871
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_root_ca_contains_cert_policy: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Microsoft EV RSA Root Certificate Authority 2017

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 4D4D06CB146909874554F8597D1B131F
- SHA-256: 66960242DB2ED5906E113295F2454F33D6FB418C4C65E8166D43BE64D19BA4FA
- SPKI SHA-256: 68AA635451D83962167E88FB08F8678D73AEC66FC559462137CFF9D1BC3D3871
- Validity: 2019-12-18 to 2042-07-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=54741c3e-0fb2-4a81-a30f-4d21780ce1f8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28234a18-b64b-429d-b3ce-179c9512dbe1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=afa8cdc0-5a66-43a7-aed7-34ade9000c6c
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:4d:06:cb:14:69:09:87:45:54:f8:59:7d:1b:13:1f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: Dec 18 21:59:55 2019 GMT
            Not After : Jul 18 22:09:09 2042 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 66960242DB2ED5906E113295F2454F33D6FB418C4C65E8166D43BE64D19BA4FA
    SPKI SHA256: 68AA635451D83962167E88FB08F8678D73AEC66FC559462137CFF9D1BC3D3871
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft Identity Verification Root Certificate Authority 2020

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Identity Verification Root Certificate Authority 2020
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Identity Verification Root Certificate Authority 2020
- Serial: 5498D2D1D45B1995481379C811C08799
- SHA-256: 5367F20C7ADE0E2BCA790915056D086B720C33C1FA2A2661ACF787E3292E1270
- SPKI SHA-256: DEDB13BCDE2375995A1C37BD68A7C4A82AF5CBB9C4DF821B62D5733009028F07
- Validity: 2020-04-16 to 2045-04-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_ThirdParty_CPS_v1.0.5.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28efc2e1-0a2a-48c8-9ec0-5343118da987, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=dc446edf-d5ff-4fdd-b35a-853136236051, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=40dcb320-db79-46c3-a381-c134a6095da3
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20identity%20verification%20root%20certificate%20authority%202020.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft Identity Verification Root Certificate Authority 2020
        Validity
            Not Before: Apr 16 18:36:16 2020 GMT
            Not After : Apr 16 18:44:40 2045 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Identity Verification Root Certificate Authority 2020
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C8:7E:D2:6A:85:2A:1B:CA:19:98:04:07:27:CF:50:10:4F:68:A8:A2
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5367F20C7ADE0E2BCA790915056D086B720C33C1FA2A2661ACF787E3292E1270
    SPKI SHA256: DEDB13BCDE2375995A1C37BD68A7C4A82AF5CBB9C4DF821B62D5733009028F07
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft Root Authority

- Subject: organizationalUnitName=Copyright (c) 1997 Microsoft Corp., organizationalUnitName=Microsoft Corporation, commonName=Microsoft Root Authority
- Issuer: organizationalUnitName=Copyright (c) 1997 Microsoft Corp., organizationalUnitName=Microsoft Corporation, commonName=Microsoft Root Authority
- Serial: C1008B3C3C8811D13EF663ECDF40
- SHA-256: F38406E540D7A9D90CB4A9479299640FFB6DF9E224ECC7A01C0D9558D8DAD77D
- SPKI SHA-256: 4462C107C485DD6A5443F5E7A1604416034A374C3F4D10875F1C3715027563AF
- Validity: 1997-01-10 to 2020-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-MD5

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CP_v2.1.pdf, https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CPS_v2.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2081&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
        Signature Algorithm: md5WithRSAEncryption
        Issuer: OU = Copyright (c) 1997 Microsoft Corp., OU = Microsoft Corporation, CN = Microsoft Root Authority
        Validity
            Not Before: Jan 10 07:00:00 1997 GMT
            Not After : Dec 31 07:00:00 2020 GMT
        Subject: OU = Copyright (c) 1997 Microsoft Corp., OU = Microsoft Corporation, CN = Microsoft Root Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            2.5.29.1:
                0....[.p.ir.#Q~..M....r0p1+0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority......<<...>.c..@
    Signature Algorithm: md5WithRSAEncryption
    SHA256 Fingerprint: F38406E540D7A9D90CB4A9479299640FFB6DF9E224ECC7A01C0D9558D8DAD77D
    SPKI SHA256: 4462C107C485DD6A5443F5E7A1604416034A374C3F4D10875F1C3715027563AF
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_signature_algorithm_not_supported: 

#### Computed Flags

- is_root_ca
- is_self_signed
- is_ca
- is_expired

### Microsoft Root Certificate Authority

- Subject: domainComponent=com, domainComponent=microsoft, commonName=Microsoft Root Certificate Authority
- Issuer: domainComponent=com, domainComponent=microsoft, commonName=Microsoft Root Certificate Authority
- Serial: 79AD16A14AA0A5AD4C7358F407132E65
- SHA-256: 885DE64C340E3EA70658F01E1145F957FCDA27AABEEA1AB9FAA9FDB0102D4077
- SPKI SHA-256: DF530BAC9FCD914C252C2FBDCEDDC6183D4AE8C680AD65F03E204861DD7B1C73
- Validity: 2001-05-09 to 2021-05-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CP_v2.1.pdf, https://www.microsoft.com/pkiops/docs/Microsoft_PRSS_PKI_CPS_v2.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2081&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, nonRepudiation, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: DC = com, DC = microsoft, CN = Microsoft Root Certificate Authority
        Validity
            Not Before: May  9 23:19:22 2001 GMT
            Not After : May  9 23:28:13 2021 GMT
        Subject: DC = com, DC = microsoft, CN = Microsoft Root Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                0E:AC:82:60:40:56:27:97:E5:25:13:FC:2A:E1:0A:53:95:59:E4:A4
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 885DE64C340E3EA70658F01E1145F957FCDA27AABEEA1AB9FAA9FDB0102D4077
    SPKI SHA256: DF530BAC9FCD914C252C2FBDCEDDC6183D4AE8C680AD65F03E204861DD7B1C73
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, nonRepudiation, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_root_ca_key_usage_must_be_critical: 
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- is_expired

### Microsoft RSA Root Certificate Authority 2017

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 29C87039F4DBFDB94DBCDA6CA792836B
- SHA-256: ECDD47B5ACBFA328211E1BFF54ADEAC95E6991E3C1D50E27B527E903208040A1
- SPKI SHA-256: B2F7298B52BF2C3CAC4DDFE72DE4D682AC58957595982F2B62301AF597C699C5
- Validity: 2017-07-26 to 2042-07-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=70ae9251-8e87-4ce4-963c-b712e66ee502, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=741b964d-cb23-42ea-a083-127b322a9f4f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=7c20c02c-f0b0-4363-ae9a-8ab4a7616da1
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:c8:70:39:f4:db:fd:b9:4d:bc:da:6c:a7:92:83:6b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 26 22:07:17 2017 GMT
            Not After : Jul 26 22:15:47 2042 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: ECDD47B5ACBFA328211E1BFF54ADEAC95E6991E3C1D50E27B527E903208040A1
    SPKI SHA256: B2F7298B52BF2C3CAC4DDFE72DE4D682AC58957595982F2B62301AF597C699C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_root_ca_contains_cert_policy: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Microsoft RSA Root Certificate Authority 2017

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 1ED397095FD8B4B347701EAABE7F45B3
- SHA-256: C741F70F4B2A8D88BF2E71C14122EF53EF10EBA0CFA5E64CFA20F418853073E0
- SPKI SHA-256: B2F7298B52BF2C3CAC4DDFE72DE4D682AC58957595982F2B62301AF597C699C5
- Validity: 2019-12-18 to 2042-07-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_CP_v3.2.0.pdf, https://www.microsoft.com/pkiops/Docs/Content/policy/Microsoft_PKI_Services_public_tls_CPS_v3.3.6.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=28efc2e1-0a2a-48c8-9ec0-5343118da987, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=dc446edf-d5ff-4fdd-b35a-853136236051, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=0436398e-8a3b-42d4-84c8-f15b4149087c
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:d3:97:09:5f:d8:b4:b3:47:70:1e:aa:be:7f:45:b3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Dec 18 22:51:22 2019 GMT
            Not After : Jul 18 23:00:23 2042 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C741F70F4B2A8D88BF2E71C14122EF53EF10EBA0CFA5E64CFA20F418853073E0
    SPKI SHA256: B2F7298B52BF2C3CAC4DDFE72DE4D682AC58957595982F2B62301AF597C699C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft TLS ECC Root G2

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2
- Serial: 72E2022BC5B2C1B04D25056E62E27679
- SHA-256: 87755CFE88BDB0D1099DCDED3EAE114BA976E664B3248EE3DC649E357F17E8A7
- SPKI SHA-256: FE2689A17DAC807728DAC96EC65496366A4ED5DEBF7D21C670C3704061EABBA5
- Validity: 2025-04-10 to 2040-04-10
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:e2:02:2b:c5:b2:c1:b0:4d:25:05:6e:62:e2:76:79
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS ECC Root G2
        Validity
            Not Before: Apr 10 20:52:36 2025 GMT
            Not After : Apr 10 20:58:59 2040 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS ECC Root G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                6F:AB:7E:DA:FF:97:43:72:EC:3B:67:77:DE:82:61:35:88:47:42:85
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 87755CFE88BDB0D1099DCDED3EAE114BA976E664B3248EE3DC649E357F17E8A7
    SPKI SHA256: FE2689A17DAC807728DAC96EC65496366A4ED5DEBF7D21C670C3704061EABBA5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft TLS RSA Root G2

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 6486E3B269180FBF4040392E2E534B9B
- SHA-256: 6A170583DB584151E1C454EECA2A64CC5D8E484A5BD1156E720B4458654EE9E5
- SPKI SHA-256: 4B03C9966C863B2C008A95A5ED9254070448C7B219D283102F6A6C5B6E8E2ACD
- Validity: 2025-04-10 to 2040-04-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20tls%20rsa%20root%20g2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:86:e3:b2:69:18:0f:bf:40:40:39:2e:2e:53:4b:9b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Apr 10 18:36:30 2025 GMT
            Not After : Apr 10 18:43:51 2040 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6A170583DB584151E1C454EECA2A64CC5D8E484A5BD1156E720B4458654EE9E5
    SPKI SHA256: 4B03C9966C863B2C008A95A5ED9254070448C7B219D283102F6A6C5B6E8E2ACD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Microsoft Azure ECC TLS Issuing CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001AA9564F44321C54B900000000001A
- SHA-256: 2CAEFBB55E70DF5A8985FE9BC10DD56A40C3DEDAB3DA1530A29682015C5B7C66
- SPKI SHA-256: 3993B1F49242DC9B120D28C55F6884037FC40FA80285ADCBD59ACE791368CB1F
- Validity: 2020-01-17 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20ecc%20tls%20issuing%20ca%2001.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1a:a9:56:4f:44:32:1c:54:b9:00:00:00:00:00:1a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:28:04 2020 GMT
            Not After : Jun 27 20:28:04 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                AA:FD:30:0D:D7:A2:D5:EF:8A:7A:77:31:AA:66:A6:C2:6C:11:BB:6F
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2CAEFBB55E70DF5A8985FE9BC10DD56A40C3DEDAB3DA1530A29682015C5B7C66
    SPKI SHA256: 3993B1F49242DC9B120D28C55F6884037FC40FA80285ADCBD59ACE791368CB1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 01

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure ECC TLS Issuing CA 01
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001055AEEAD40D6C1E58000000000010
- SHA-256: 349EA6A61BE292CBDB9E2C25351B0DBEFF323AB1A37E53AE256A84AFCA321894
- SPKI SHA-256: 3993B1F49242DC9B120D28C55F6884037FC40FA80285ADCBD59ACE791368CB1F
- Validity: 2019-06-27 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:10:55:ae:ea:d4:0d:6c:1e:58:00:00:00:00:00:10
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:10:47 2019 GMT
            Not After : Jun 27 21:10:47 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft Azure ECC TLS Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                AA:FD:30:0D:D7:A2:D5:EF:8A:7A:77:31:AA:66:A6:C2:6C:11:BB:6F
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 349EA6A61BE292CBDB9E2C25351B0DBEFF323AB1A37E53AE256A84AFCA321894
    SPKI SHA256: 3993B1F49242DC9B120D28C55F6884037FC40FA80285ADCBD59ACE791368CB1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001B498D6736ED5612C200000000001B
- SHA-256: 4EC439672A443401A66E27947CC3B5897F132B667F712CC1A37018A3CC85B16A
- SPKI SHA-256: 3A175427EC2BA4F46DA57E77B64CAA54B290A0DA5D0825AF7BC31041A4034360
- Validity: 2020-01-17 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20ecc%20tls%20issuing%20ca%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1b:49:8d:67:36:ed:56:12:c2:00:00:00:00:00:1b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:28:09 2020 GMT
            Not After : Jun 27 20:28:09 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                9D:E5:0E:77:37:47:9E:09:33:D9:90:BE:2A:09:C2:12:7F:4E:D2:A3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4EC439672A443401A66E27947CC3B5897F132B667F712CC1A37018A3CC85B16A
    SPKI SHA256: 3A175427EC2BA4F46DA57E77B64CAA54B290A0DA5D0825AF7BC31041A4034360
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure ECC TLS Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 3300000011B4F6B33883A1EC67000000000011
- SHA-256: 07E265D6A24EAD2BA42ED90A54381F15919DADCE0082D70DC44EB26A357D0621
- SPKI SHA-256: 3A175427EC2BA4F46DA57E77B64CAA54B290A0DA5D0825AF7BC31041A4034360
- Validity: 2019-06-27 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:11:b4:f6:b3:38:83:a1:ec:67:00:00:00:00:00:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:10:48 2019 GMT
            Not After : Jun 27 21:10:48 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft Azure ECC TLS Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                9D:E5:0E:77:37:47:9E:09:33:D9:90:BE:2A:09:C2:12:7F:4E:D2:A3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 07E265D6A24EAD2BA42ED90A54381F15919DADCE0082D70DC44EB26A357D0621
    SPKI SHA256: 3A175427EC2BA4F46DA57E77B64CAA54B290A0DA5D0825AF7BC31041A4034360
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 03

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 03
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000003322A2579B5E698BCC000000000033
- SHA-256: 2EC9A5BA68B60F81E5F8662F7645743CCE1EDCE06AF686C775431F7BBB69ABD4
- SPKI SHA-256: 67A346346B49A8ABAC45DA47C5CA9ADCF0CD1C437CBD2B685FE58B83DC6DE2DE
- Validity: 2023-05-25 to 2028-05-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2003_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:33:22:a2:57:9b:5e:69:8b:cc:00:00:00:00:00:33
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:47:57 2023 GMT
            Not After : May 25 23:47:57 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 03
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                72:E0:96:A1:51:EA:30:0C:58:B5:F5:19:AB:9A:7C:CD:97:55:10:2E
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2EC9A5BA68B60F81E5F8662F7645743CCE1EDCE06AF686C775431F7BBB69ABD4
    SPKI SHA256: 67A346346B49A8ABAC45DA47C5CA9ADCF0CD1C437CBD2B685FE58B83DC6DE2DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure ECC TLS Issuing CA 04

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 04
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 33000000322164AEDAB61F509D000000000032
- SHA-256: 4D0F5DA23B099209B048E1871B4BB1C4B4E812E3FA0249BB8D19E00FFA9E91BC
- SPKI SHA-256: 118C8194DC6A894DF9FD2E4317F4F57E92998EEE8CF7850270B8D1438EF57C16
- Validity: 2023-05-25 to 2028-05-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2004_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:32:21:64:ae:da:b6:1f:50:9d:00:00:00:00:00:32
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:47:55 2023 GMT
            Not After : May 25 23:47:55 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 04
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                35:F1:E7:11:32:68:E6:B2:C8:DA:71:E6:70:F3:E8:3C:B8:0E:07:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4D0F5DA23B099209B048E1871B4BB1C4B4E812E3FA0249BB8D19E00FFA9E91BC
    SPKI SHA256: 118C8194DC6A894DF9FD2E4317F4F57E92998EEE8CF7850270B8D1438EF57C16
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure ECC TLS Issuing CA 05

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure ECC TLS Issuing CA 05
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 33000000120DF640D81AAF81DC000000000012
- SHA-256: 22DBF3D1B7E6C28105D493591B0180AA6B794CB7FD27D289EC920C74F7C6769A
- SPKI SHA-256: 934F4CCE6C2244F90F9A4A60994B69ACC93FB802D255E74D2ED7CE06408CBD71
- Validity: 2019-06-27 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:12:0d:f6:40:d8:1a:af:81:dc:00:00:00:00:00:12
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:10:48 2019 GMT
            Not After : Jun 27 21:10:48 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft Azure ECC TLS Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                55:DF:EE:1E:27:AC:F2:9E:2B:9E:80:39:35:79:56:47:3A:CE:B3:10
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 22DBF3D1B7E6C28105D493591B0180AA6B794CB7FD27D289EC920C74F7C6769A
    SPKI SHA256: 934F4CCE6C2244F90F9A4A60994B69ACC93FB802D255E74D2ED7CE06408CBD71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 05

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 05
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001CC0D2A3CD78CF2C1000000000001C
- SHA-256: 624D5576A652B2130768BFE84B965EEFFFD91603D25CD5F7155A7DC2789DAC38
- SPKI SHA-256: 934F4CCE6C2244F90F9A4A60994B69ACC93FB802D255E74D2ED7CE06408CBD71
- Validity: 2020-01-17 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20ecc%20tls%20issuing%20ca%2005.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1c:c0:d2:a3:cd:78:cf:2c:10:00:00:00:00:00:1c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:28:10 2020 GMT
            Not After : Jun 27 20:28:10 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                55:DF:EE:1E:27:AC:F2:9E:2B:9E:80:39:35:79:56:47:3A:CE:B3:10
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 624D5576A652B2130768BFE84B965EEFFFD91603D25CD5F7155A7DC2789DAC38
    SPKI SHA256: 934F4CCE6C2244F90F9A4A60994B69ACC93FB802D255E74D2ED7CE06408CBD71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure ECC TLS Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001319E7C72D85E33B35000000000013
- SHA-256: 7067971C54988DDACCAB5B0C126414A1D17CF01E3D60F97F41BE9C06D1BD6ECE
- SPKI SHA-256: C818E7ADC99C529DA7CA50D15A742F48F46CA66866D5FFDF3AE2ABB0D89A49D0
- Validity: 2019-06-27 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:13:19:e7:c7:2d:85:e3:3b:35:00:00:00:00:00:13
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:10:49 2019 GMT
            Not After : Jun 27 21:10:49 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft Azure ECC TLS Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                1F:CE:C7:9D:64:53:5F:B6:FC:95:07:AE:95:26:33:51:C1:27:D9:26
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7067971C54988DDACCAB5B0C126414A1D17CF01E3D60F97F41BE9C06D1BD6ECE
    SPKI SHA256: C818E7ADC99C529DA7CA50D15A742F48F46CA66866D5FFDF3AE2ABB0D89A49D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 06

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 06
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001D0913C309DA3F05A600000000001D
- SHA-256: 151A3E5969C6616EB637A8722B174CFD95387AACE78D57C3BD23F0CB3008186A
- SPKI SHA-256: C818E7ADC99C529DA7CA50D15A742F48F46CA66866D5FFDF3AE2ABB0D89A49D0
- Validity: 2020-01-17 to 2024-06-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20ecc%20tls%20issuing%20ca%2006.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1d:09:13:c3:09:da:3f:05:a6:00:00:00:00:00:1d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:28:14 2020 GMT
            Not After : Jun 27 20:28:14 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                1F:CE:C7:9D:64:53:5F:B6:FC:95:07:AE:95:26:33:51:C1:27:D9:26
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 151A3E5969C6616EB637A8722B174CFD95387AACE78D57C3BD23F0CB3008186A
    SPKI SHA256: C818E7ADC99C529DA7CA50D15A742F48F46CA66866D5FFDF3AE2ABB0D89A49D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure ECC TLS Issuing CA 07

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 07
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 3300000034C732435DB22A0A2B000000000034
- SHA-256: BD3816423553ED993FA44A02F5562470C0CFB0D3B00532E3526A4A3AEC87522F
- SPKI SHA-256: 54E6D14C32E54FF17E8144AE41A707EB68D13F3721D72354EA81B147382CC9C9
- Validity: 2023-05-25 to 2028-05-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2007_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:34:c7:32:43:5d:b2:2a:0a:2b:00:00:00:00:00:34
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:48:00 2023 GMT
            Not After : May 25 23:48:00 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 07
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C3:5E:AC:40:76:C0:06:4D:E3:2B:94:99:30:60:73:34:98:29:C6:51
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BD3816423553ED993FA44A02F5562470C0CFB0D3B00532E3526A4A3AEC87522F
    SPKI SHA256: 54E6D14C32E54FF17E8144AE41A707EB68D13F3721D72354EA81B147382CC9C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure ECC TLS Issuing CA 08

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure ECC TLS Issuing CA 08
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 3300000031526979844798BBB8000000000031
- SHA-256: 2C99B917B7A068578F7EFB4FB8E60B9CB5A0E73BF300E0E1DC112E5654C5AE52
- SPKI SHA-256: FBDCD3B55BC841CEF4B70DF21B5CBA762BD69F16DD0157F36E079AD5FD963AD3
- Validity: 2023-05-25 to 2028-05-25
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20ECC%20TLS%20Issuing%20CA%2008_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:31:52:69:79:84:47:98:bb:b8:00:00:00:00:00:31
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:47:51 2023 GMT
            Not After : May 25 23:47:51 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure ECC TLS Issuing CA 08
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                AD:54:1D:03:54:71:C6:2F:5E:D6:5B:18:58:CE:6E:24:C5:D6:A2:0A
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2C99B917B7A068578F7EFB4FB8E60B9CB5A0E73BF300E0E1DC112E5654C5AE52
    SPKI SHA256: FBDCD3B55BC841CEF4B70DF21B5CBA762BD69F16DD0157F36E079AD5FD963AD3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure RSA TLS Issuing CA 03

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 03
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000003968EA517D8A7E30CE000000000039
- SHA-256: 3D3F4B440F933FFD269565EDA9E20E8DF863C9CBE3651D3B476C5B4F4AF5CE28
- SPKI SHA-256: 664581A2D0B89CBF816BF9176953F1ED3A6845217DBB0C4402EB9FCFAEC9EEC4
- Validity: 2023-05-25 to 2028-05-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2003_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:39:68:ea:51:7d:8a:7e:30:ce:00:00:00:00:00:39
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:49:25 2023 GMT
            Not After : May 25 23:49:25 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure RSA TLS Issuing CA 03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                FE:09:71:40:55:05:10:44:D8:A4:81:75:B8:9E:1A:E9:4A:06:88:C8
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3D3F4B440F933FFD269565EDA9E20E8DF863C9CBE3651D3B476C5B4F4AF5CE28
    SPKI SHA256: 664581A2D0B89CBF816BF9176953F1ED3A6845217DBB0C4402EB9FCFAEC9EEC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure RSA TLS Issuing CA 04

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 04
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000003CD7CB44EE579961D000000000003C
- SHA-256: FD39FFC48F148354262162A2F55DD46DC2564CFC1499309AD53F09C10981DCCA
- SPKI SHA-256: 13EFAE8DDADB64C188274780F505C2087B390FC001788CD0DA602A1CF14DFA0B
- Validity: 2023-05-25 to 2028-05-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:3c:d7:cb:44:ee:57:99:61:d0:00:00:00:00:00:3c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:49:33 2023 GMT
            Not After : May 25 23:49:33 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure RSA TLS Issuing CA 04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                3B:70:D1:53:E9:76:25:9D:60:A8:CA:66:0F:C6:9B:AE:6F:54:16:6A
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FD39FFC48F148354262162A2F55DD46DC2564CFC1499309AD53F09C10981DCCA
    SPKI SHA256: 13EFAE8DDADB64C188274780F505C2087B390FC001788CD0DA602A1CF14DFA0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure RSA TLS Issuing CA 07

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 07
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000003BF980B0C83783431700000000003B
- SHA-256: FBB7926A451BADF516BE518614A77E6E325E29819908796D807F59320F918EE2
- SPKI SHA-256: 31F9A88B6C0A6F1242A48E78241EC1F8F3CD90EF1D44EE750696E9F86BB86858
- Validity: 2023-05-25 to 2028-05-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:3b:f9:80:b0:c8:37:83:43:17:00:00:00:00:00:3b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:49:30 2023 GMT
            Not After : May 25 23:49:30 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure RSA TLS Issuing CA 07
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                CE:15:16:3B:EA:02:A3:A6:6B:DA:D9:2B:FD:E5:8C:52:BE:7A:50:A8
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FBB7926A451BADF516BE518614A77E6E325E29819908796D807F59320F918EE2
    SPKI SHA256: 31F9A88B6C0A6F1242A48E78241EC1F8F3CD90EF1D44EE750696E9F86BB86858
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure RSA TLS Issuing CA 08

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure RSA TLS Issuing CA 08
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000003A5DC2FFC321C16D9B00000000003A
- SHA-256: CFDD061FCD4CFF3BB9E133264CA7FDE45CA49B70CFAA977AE0DC422B4330A8C1
- SPKI SHA-256: 2E366D8D78D767AC42E76C58A5BAA8FBB88278C1C707768DBB4E3E3C9B43C988
- Validity: 2023-05-25 to 2028-05-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20rsa%20tls%20issuing%20ca%2008.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:3a:5d:c2:ff:c3:21:c1:6d:9b:00:00:00:00:00:3a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 25 23:49:28 2023 GMT
            Not After : May 25 23:49:28 2028 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure RSA TLS Issuing CA 08
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                F6:7E:2F:BD:80:A3:4A:B2:70:5B:EB:DF:9A:1F:D8:ED:CA:61:80:07
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CFDD061FCD4CFF3BB9E133264CA7FDE45CA49B70CFAA977AE0DC422B4330A8C1
    SPKI SHA256: 2E366D8D78D767AC42E76C58A5BAA8FBB88278C1C707768DBB4E3E3C9B43C988
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft Azure TLS Issuing CA 01

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure TLS Issuing CA 01
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000106A1A1B11367DA895000000000010
- SHA-256: 66342CA7E05968238D9FB9FE494FEBB85C287570506E345CA23FA731174091E9
- SPKI SHA-256: 347C2EB1B0BBC3CE382734E6BC8448A3C34BEC3E92B484CAF69873160B498B4C
- Validity: 2019-06-27 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:10:6a:1a:1b:11:36:7d:a8:95:00:00:00:00:00:10
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:09:06 2019 GMT
            Not After : Jun 27 21:09:06 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft Azure TLS Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                0F:20:5D:D7:A1:57:95:DB:92:CF:2B:D0:C7:C2:77:04:CE:72:80:76
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 66342CA7E05968238D9FB9FE494FEBB85C287570506E345CA23FA731174091E9
    SPKI SHA256: 347C2EB1B0BBC3CE382734E6BC8448A3C34BEC3E92B484CAF69873160B498B4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000001DBE9496F3DB8B8DE700000000001D
- SHA-256: 0437AB2EC2C2B4890296C135034B21DB146434B8317EE703AA8AA943C5EA51AE
- SPKI SHA-256: 347C2EB1B0BBC3CE382734E6BC8448A3C34BEC3E92B484CAF69873160B498B4C
- Validity: 2020-01-17 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20tls%20issuing%20ca%2001.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1d:be:94:96:f3:db:8b:8d:e7:00:00:00:00:00:1d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:22:47 2020 GMT
            Not After : Jun 27 20:22:47 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure TLS Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                0F:20:5D:D7:A1:57:95:DB:92:CF:2B:D0:C7:C2:77:04:CE:72:80:76
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0437AB2EC2C2B4890296C135034B21DB146434B8317EE703AA8AA943C5EA51AE
    SPKI SHA256: 347C2EB1B0BBC3CE382734E6BC8448A3C34BEC3E92B484CAF69873160B498B4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft Azure TLS Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000011BDBFDD77D4CAB858000000000011
- SHA-256: 647EF2DFAFAC46D8FC9C873D7C4BABF3F1C032AE62B58D6DA7B21F92EB1CAE7D
- SPKI SHA-256: CC0C1FC76885710E6F30E09CF6FB7E3172DD2E5D3C12AB8DB0E5A00C5D213B0F
- Validity: 2019-06-27 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:11:bd:bf:dd:77:d4:ca:b8:58:00:00:00:00:00:11
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:09:07 2019 GMT
            Not After : Jun 27 21:09:07 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft Azure TLS Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                00:AB:91:FC:21:62:26:97:9A:A8:79:1B:61:41:90:60:A9:62:67:FD
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 647EF2DFAFAC46D8FC9C873D7C4BABF3F1C032AE62B58D6DA7B21F92EB1CAE7D
    SPKI SHA256: CC0C1FC76885710E6F30E09CF6FB7E3172DD2E5D3C12AB8DB0E5A00C5D213B0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000001EC6749F058517B4D000000000001E
- SHA-256: D39CE39FF6F449D4F3391EE2004D705EC22F99CFFCA40A88F85DB26454ADDBD1
- SPKI SHA-256: CC0C1FC76885710E6F30E09CF6FB7E3172DD2E5D3C12AB8DB0E5A00C5D213B0F
- Validity: 2020-01-17 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20tls%20issuing%20ca%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1e:c6:74:9f:05:85:17:b4:d0:00:00:00:00:00:1e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:22:48 2020 GMT
            Not After : Jun 27 20:22:48 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure TLS Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                00:AB:91:FC:21:62:26:97:9A:A8:79:1B:61:41:90:60:A9:62:67:FD
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D39CE39FF6F449D4F3391EE2004D705EC22F99CFFCA40A88F85DB26454ADDBD1
    SPKI SHA256: CC0C1FC76885710E6F30E09CF6FB7E3172DD2E5D3C12AB8DB0E5A00C5D213B0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 05

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure TLS Issuing CA 05
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000120D9A4D386CF31997000000000012
- SHA-256: C82AB0028E22101A813F02A80AD7114BDE3EC4E7E66D37F5681A6DC1E141223B
- SPKI SHA-256: E22E21D2337D3513ABD7128923E4D0D50FD921F5233CC5ED99652C0D1DCF8E2C
- Validity: 2019-06-27 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:12:0d:9a:4d:38:6c:f3:19:97:00:00:00:00:00:12
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:09:09 2019 GMT
            Not After : Jun 27 21:09:09 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft Azure TLS Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C7:B2:9C:7F:1C:E3:B8:5A:EF:E9:68:1A:A8:5D:94:C1:26:52:6A:68
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C82AB0028E22101A813F02A80AD7114BDE3EC4E7E66D37F5681A6DC1E141223B
    SPKI SHA256: E22E21D2337D3513ABD7128923E4D0D50FD921F5233CC5ED99652C0D1DCF8E2C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 05

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 05
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000001F9F1FA2043BC28DB900000000001F
- SHA-256: AB3203B3EA2017D509726A1D82293EFFCB8C42CEB52C9AF1C0EEE96B5C02BCBA
- SPKI SHA-256: E22E21D2337D3513ABD7128923E4D0D50FD921F5233CC5ED99652C0D1DCF8E2C
- Validity: 2020-01-17 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20tls%20issuing%20ca%2005.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:1f:9f:1f:a2:04:3b:c2:8d:b9:00:00:00:00:00:1f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:22:49 2020 GMT
            Not After : Jun 27 20:22:49 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure TLS Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C7:B2:9C:7F:1C:E3:B8:5A:EF:E9:68:1A:A8:5D:94:C1:26:52:6A:68
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AB3203B3EA2017D509726A1D82293EFFCB8C42CEB52C9AF1C0EEE96B5C02BCBA
    SPKI SHA256: E22E21D2337D3513ABD7128923E4D0D50FD921F5233CC5ED99652C0D1DCF8E2C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft Azure TLS Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000013D4995E0B99796C9B000000000013
- SHA-256: 41830FE41CA1C0BEB2CD319EF4A2D2FD1D2164086509CA4CF90670B0CD0A6A6C
- SPKI SHA-256: 5A5F0C158FBDCE28C61BC4201070802B97E103EC9D3D9C5A2D038576210FCF75
- Validity: 2019-06-27 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:13:d4:99:5e:0b:99:79:6c:9b:00:00:00:00:00:13
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 27 21:09:10 2019 GMT
            Not After : Jun 27 21:09:10 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft Azure TLS Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                D5:C1:67:3A:C2:A3:9D:F4:77:52:5B:59:12:38:29:E6:55:68:BB:A5
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 41830FE41CA1C0BEB2CD319EF4A2D2FD1D2164086509CA4CF90670B0CD0A6A6C
    SPKI SHA256: 5A5F0C158FBDCE28C61BC4201070802B97E103EC9D3D9C5A2D038576210FCF75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Azure TLS Issuing CA 06

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft Azure TLS Issuing CA 06
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000020A2F1491A37FBD31F000000000020
- SHA-256: 7DF4D3EF45798F8C4384FC702BA52A44CE7BD6298B141628D4ABABC7678F6467
- SPKI SHA-256: 5A5F0C158FBDCE28C61BC4201070802B97E103EC9D3D9C5A2D038576210FCF75
- Validity: 2020-01-17 to 2024-06-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20azure%20tls%20issuing%20ca%2006.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:20:a2:f1:49:1a:37:fb:d3:1f:00:00:00:00:00:20
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jan 17 20:22:50 2020 GMT
            Not After : Jun 27 20:22:50 2024 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft Azure TLS Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                D5:C1:67:3A:C2:A3:9D:F4:77:52:5B:59:12:38:29:E6:55:68:BB:A5
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7DF4D3EF45798F8C4384FC702BA52A44CE7BD6298B141628D4ABABC7678F6467
    SPKI SHA256: 5A5F0C158FBDCE28C61BC4201070802B97E103EC9D3D9C5A2D038576210FCF75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC Server PCA 2018

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Server PCA 2018
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 3300000002368AD5489921BF9B000000000002
- SHA-256: 25D41E8A8543371B9CADA5E7D15221D9289CF3F034F5808A8FF9D1D892E8D4DE
- SPKI SHA-256: 52F28C95713C447787C6CDCF921E56227637DAAFE824654BE0CA9773B475A5FD
- Validity: 2018-02-28 to 2033-02-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:02:36:8a:d5:48:99:21:bf:9b:00:00:00:00:00:02
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Feb 28 22:03:04 2018 GMT
            Not After : Feb 28 22:13:04 2033 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Server PCA 2018
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                1F:90:14:B6:3D:7A:B4:C1:D5:4A:2E:3D:DB:82:E3:25:2B:5B:44:79
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 25D41E8A8543371B9CADA5E7D15221D9289CF3F034F5808A8FF9D1D892E8D4DE
    SPKI SHA256: 52F28C95713C447787C6CDCF921E56227637DAAFE824654BE0CA9773B475A5FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Microsoft ECC TLS Issuing AOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 33000000282BFD23E7D1ADD707000000000028
- SHA-256: 5C64B1731A8138DEA7D11C9AE8622891F945EBA46825E7ABFE4754F0A6011AF8
- SPKI SHA-256: A9DF77A5BFB79FA34CDB975D964A30D9FE7FC4E670BD39BF1B8C2605E843DB54
- Validity: 2021-06-24 to 2026-06-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20ecc%20tls%20issuing%20aoc%20ca%2001.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:28:2b:fd:23:e7:d1:ad:d7:07:00:00:00:00:00:28
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 19:58:36 2021 GMT
            Not After : Jun 24 19:58:36 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing AOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                31:5B:B9:CE:51:1B:7C:D1:AA:03:C0:EB:ED:36:5D:C2:9D:D3:89:E1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5C64B1731A8138DEA7D11C9AE8622891F945EBA46825E7ABFE4754F0A6011AF8
    SPKI SHA256: A9DF77A5BFB79FA34CDB975D964A30D9FE7FC4E670BD39BF1B8C2605E843DB54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing AOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000002378F1186465D367C2000000000023
- SHA-256: 9D8BB150C07B81C25799B7945978B036E4B49C593C882BE379A58D08E1C25074
- SPKI SHA-256: A9DF77A5BFB79FA34CDB975D964A30D9FE7FC4E670BD39BF1B8C2605E843DB54
- Validity: 2021-03-11 to 2026-03-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:23:78:f1:18:64:65:d3:67:c2:00:00:00:00:00:23
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:12 2021 GMT
            Not After : Mar 11 21:46:12 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing AOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                31:5B:B9:CE:51:1B:7C:D1:AA:03:C0:EB:ED:36:5D:C2:9D:D3:89:E1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9D8BB150C07B81C25799B7945978B036E4B49C593C882BE379A58D08E1C25074
    SPKI SHA256: A9DF77A5BFB79FA34CDB975D964A30D9FE7FC4E670BD39BF1B8C2605E843DB54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing AOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 33000000290F8A6222EF6A5695000000000029
- SHA-256: 808CA1ABBFE2FF1A9AC71887DDA71FF6FCA6C3B5224827F547515A4D9F7AF209
- SPKI SHA-256: 85FA29EB740D90CE77EDDBE3AB6C66A5DE3FC8BA94D6B2955FB7D33B04231601
- Validity: 2021-06-24 to 2026-06-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20ecc%20tls%20issuing%20aoc%20ca%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:29:0f:8a:62:22:ef:6a:56:95:00:00:00:00:00:29
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 19:58:38 2021 GMT
            Not After : Jun 24 19:58:38 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing AOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                DE:DC:D7:6C:23:99:43:EA:AC:ED:C8:B7:1D:18:58:80:36:4B:8D:F4
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 808CA1ABBFE2FF1A9AC71887DDA71FF6FCA6C3B5224827F547515A4D9F7AF209
    SPKI SHA256: 85FA29EB740D90CE77EDDBE3AB6C66A5DE3FC8BA94D6B2955FB7D33B04231601
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing AOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing AOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000002404E553405F2DAAD3000000000024
- SHA-256: 12FB2F53AC2D09E62128B00487E8B77D6E4A0F459DD8744D009393BD0DF697B5
- SPKI SHA-256: 85FA29EB740D90CE77EDDBE3AB6C66A5DE3FC8BA94D6B2955FB7D33B04231601
- Validity: 2021-03-11 to 2026-03-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:24:04:e5:53:40:5f:2d:aa:d3:00:00:00:00:00:24
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:13 2021 GMT
            Not After : Mar 11 21:46:13 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing AOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                DE:DC:D7:6C:23:99:43:EA:AC:ED:C8:B7:1D:18:58:80:36:4B:8D:F4
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 12FB2F53AC2D09E62128B00487E8B77D6E4A0F459DD8744D009393BD0DF697B5
    SPKI SHA256: 85FA29EB740D90CE77EDDBE3AB6C66A5DE3FC8BA94D6B2955FB7D33B04231601
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing EOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000002A2D006485FDACBFEB00000000002A
- SHA-256: 2769381532D96183ED39BDC4E323F3C520FBE6ACF3BDA30222239DDFC44C8380
- SPKI SHA-256: EDE152DA0C19D6C3BB3168D11E40901919646BB6998CD5E7D0FBE6537FFF42EF
- Validity: 2021-06-24 to 2026-06-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20ecc%20tls%20issuing%20eoc%20ca%2001.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2a:2d:00:64:85:fd:ac:bf:eb:00:00:00:00:00:2a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 19:58:39 2021 GMT
            Not After : Jun 24 19:58:39 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing EOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                BB:1C:ED:D0:88:71:A9:CA:FB:CD:93:5F:71:79:22:35:78:C6:9A:CA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2769381532D96183ED39BDC4E323F3C520FBE6ACF3BDA30222239DDFC44C8380
    SPKI SHA256: EDE152DA0C19D6C3BB3168D11E40901919646BB6998CD5E7D0FBE6537FFF42EF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing EOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000002571AFE0D5AEE7A2F5000000000025
- SHA-256: 568E4046F384D0FDD9D06A8029E6BF38EED8904C1E0B44F99DA607F68672093E
- SPKI SHA-256: EDE152DA0C19D6C3BB3168D11E40901919646BB6998CD5E7D0FBE6537FFF42EF
- Validity: 2021-03-11 to 2026-03-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:25:71:af:e0:d5:ae:e7:a2:f5:00:00:00:00:00:25
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:14 2021 GMT
            Not After : Mar 11 21:46:14 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing EOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                BB:1C:ED:D0:88:71:A9:CA:FB:CD:93:5F:71:79:22:35:78:C6:9A:CA
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 568E4046F384D0FDD9D06A8029E6BF38EED8904C1E0B44F99DA607F68672093E
    SPKI SHA256: EDE152DA0C19D6C3BB3168D11E40901919646BB6998CD5E7D0FBE6537FFF42EF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing EOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 33000000269AB02DDE29ABBCF7000000000026
- SHA-256: 2DEEA0712931179BF1EF721070A30A1AB997F64C683EAB88DCE258D040D9AD25
- SPKI SHA-256: 21CD47E3200B2D7F13567DF9E698EC21ACAC77A8F4A2A1173F4EAB23B2048967
- Validity: 2021-03-11 to 2026-03-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:26:9a:b0:2d:de:29:ab:bc:f7:00:00:00:00:00:26
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:15 2021 GMT
            Not After : Mar 11 21:46:15 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing EOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                BF:D8:32:34:2B:A1:95:3B:B4:B5:D4:B9:40:2D:72:4A:9C:1A:00:86
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2DEEA0712931179BF1EF721070A30A1AB997F64C683EAB88DCE258D040D9AD25
    SPKI SHA256: 21CD47E3200B2D7F13567DF9E698EC21ACAC77A8F4A2A1173F4EAB23B2048967
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft ECC TLS Issuing EOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC TLS Issuing EOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000002BE6902838672B667900000000002B
- SHA-256: 659C0F902D6059FBD1FCA528839F20604B80C74364E58F9D48A2291F813ED82D
- SPKI SHA-256: 21CD47E3200B2D7F13567DF9E698EC21ACAC77A8F4A2A1173F4EAB23B2048967
- Validity: 2021-06-24 to 2026-06-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20ecc%20tls%20issuing%20eoc%20ca%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2b:e6:90:28:38:67:2b:66:79:00:00:00:00:00:2b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 19:58:40 2021 GMT
            Not After : Jun 24 19:58:40 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft ECC TLS Issuing EOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                BF:D8:32:34:2B:A1:95:3B:B4:B5:D4:B9:40:2D:72:4A:9C:1A:00:86
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 659C0F902D6059FBD1FCA528839F20604B80C74364E58F9D48A2291F813ED82D
    SPKI SHA256: 21CD47E3200B2D7F13567DF9E698EC21ACAC77A8F4A2A1173F4EAB23B2048967
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft EV ECC Server PCA 2018

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Server PCA 2018
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 3300000002FD7D5D3DDBB51710000000000002
- SHA-256: D21FACBAB9FAD08EEAC926FBC6D5062B07F6A76F6B2C4C47F589418A94149C59
- SPKI SHA-256: 792A812109100CA9B3E42E698DEF9CBB54D4952FE06F455E98BA1C9CECE11CA3
- Validity: 2018-02-28 to 2033-02-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:02:fd:7d:5d:3d:db:b5:17:10:00:00:00:00:00:02
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Feb 28 21:59:22 2018 GMT
            Not After : Feb 28 22:09:22 2033 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Server PCA 2018
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C5:0F:B0:F3:EC:80:80:1B:BA:AC:3E:A1:4B:7C:16:74:9B:37:D1:D9
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D21FACBAB9FAD08EEAC926FBC6D5062B07F6A76F6B2C4C47F589418A94149C59
    SPKI SHA256: 792A812109100CA9B3E42E698DEF9CBB54D4952FE06F455E98BA1C9CECE11CA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Microsoft EV Server PCA 2018

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV Server PCA 2018
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 33000000053A9F0C06FAE17F7B000000000005
- SHA-256: 2164A69E46106175459F1CCC8257157B042C13EEA588A7F1B9AFD079FFBF28BB
- SPKI SHA-256: CFD509B58575B292F97ED9DE8A5F05F05F10C796778083A255F05C20E0AFE73A
- Validity: 2018-02-28 to 2033-02-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:05:3a:9f:0c:06:fa:e1:7f:7b:00:00:00:00:00:05
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: Feb 28 21:45:48 2018 GMT
            Not After : Feb 28 21:55:48 2033 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV Server PCA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                5D:40:B5:89:6D:0F:22:A0:A9:B4:A7:FC:AD:55:37:4C:3A:47:3F:98
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2164A69E46106175459F1CCC8257157B042C13EEA588A7F1B9AFD079FFBF28BB
    SPKI SHA256: CFD509B58575B292F97ED9DE8A5F05F05F10C796778083A255F05C20E0AFE73A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Microsoft RSA TLS Issuing AOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000265EE5CBEF101479FB000000000026
- SHA-256: 13E295A5A6ECAF8391126E752B131B316675D187266BCF537892F839454B9480
- SPKI SHA-256: 7484F2F1618D35F6F239C05BAD30B8B7AD93C7024D4000D387141417EE3DDBF4
- Validity: 2021-03-11 to 2026-03-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:26:5e:e5:cb:ef:10:14:79:fb:00:00:00:00:00:26
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:45:58 2021 GMT
            Not After : Mar 11 21:45:58 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing AOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                EB:4C:31:7C:3D:3F:32:B8:83:D7:C5:DB:7B:DA:E4:78:DA:9C:14:57
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 13E295A5A6ECAF8391126E752B131B316675D187266BCF537892F839454B9480
    SPKI SHA256: 7484F2F1618D35F6F239C05BAD30B8B7AD93C7024D4000D387141417EE3DDBF4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing AOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000002BD354825BC3B1537B00000000002B
- SHA-256: EC02314A59A303990772BDF25513D5093581257AD4E242F086F988A98FBA8B7D
- SPKI SHA-256: 7484F2F1618D35F6F239C05BAD30B8B7AD93C7024D4000D387141417EE3DDBF4
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2b:d3:54:82:5b:c3:b1:53:7b:00:00:00:00:00:2b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:03:29 2021 GMT
            Not After : Jun 24 20:03:29 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing AOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                .
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                EB:4C:31:7C:3D:3F:32:B8:83:D7:C5:DB:7B:DA:E4:78:DA:9C:14:57
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EC02314A59A303990772BDF25513D5093581257AD4E242F086F988A98FBA8B7D
    SPKI SHA256: 7484F2F1618D35F6F239C05BAD30B8B7AD93C7024D4000D387141417EE3DDBF4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_crl_sign_not_set: 
- [historical] error e_ca_key_cert_sign_not_set: 
- [historical] error e_ca_key_usage_missing: 
- [historical] error e_ext_key_usage_without_bits: 
- [historical] fatal e_incorrect_ku_encoding: KeyUsage encodings must be at least four bytes long. Got 1 bytes
- [historical] error e_key_usage_incorrect_length: the key usage ([212]) extension is not parseable.
- [historical] error e_path_len_constraint_improperly_included: 
- [historical] error e_sub_cert_not_is_ca: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing AOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000002FFAF06F6697E2469C00000000002F
- SHA-256: 481E582A206A7D7040CCDA17CF25D349785A2AB94ED7552AB254DCD38B032EC0
- SPKI SHA-256: 7484F2F1618D35F6F239C05BAD30B8B7AD93C7024D4000D387141417EE3DDBF4
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20rsa%20tls%20issuing%20aoc%20ca%2001.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2f:fa:f0:6f:66:97:e2:46:9c:00:00:00:00:00:2f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:57:35 2021 GMT
            Not After : Jun 24 20:57:35 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing AOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                EB:4C:31:7C:3D:3F:32:B8:83:D7:C5:DB:7B:DA:E4:78:DA:9C:14:57
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 481E582A206A7D7040CCDA17CF25D349785A2AB94ED7552AB254DCD38B032EC0
    SPKI SHA256: 7484F2F1618D35F6F239C05BAD30B8B7AD93C7024D4000D387141417EE3DDBF4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing AOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000030C756CC88F5C1E7EB000000000030
- SHA-256: D77C45C1587731C4632C19D6F3C9FE832626615C879EA053664A4B26EB2293EC
- SPKI SHA-256: F19A176BC779C77609427F441B995F14CAB9A19D87CDDD92725E4997CB0878BC
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20rsa%20tls%20issuing%20aoc%20ca%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:30:c7:56:cc:88:f5:c1:e7:eb:00:00:00:00:00:30
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:57:37 2021 GMT
            Not After : Jun 24 20:57:37 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing AOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                8A:96:C2:81:0D:57:8A:42:CE:30:F9:B8:C1:9D:0C:1E:53:A6:4F:E5
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D77C45C1587731C4632C19D6F3C9FE832626615C879EA053664A4B26EB2293EC
    SPKI SHA256: F19A176BC779C77609427F441B995F14CAB9A19D87CDDD92725E4997CB0878BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing AOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000002C118872BAF92B2E5600000000002C
- SHA-256: 3ACD6F50D569963EDE389E5A3D024FEF52CB537DBF497CA1725E9CE710117807
- SPKI SHA-256: F19A176BC779C77609427F441B995F14CAB9A19D87CDDD92725E4997CB0878BC
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2c:11:88:72:ba:f9:2b:2e:56:00:00:00:00:00:2c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:03:30 2021 GMT
            Not After : Jun 24 20:03:30 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing AOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                .
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                8A:96:C2:81:0D:57:8A:42:CE:30:F9:B8:C1:9D:0C:1E:53:A6:4F:E5
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3ACD6F50D569963EDE389E5A3D024FEF52CB537DBF497CA1725E9CE710117807
    SPKI SHA256: F19A176BC779C77609427F441B995F14CAB9A19D87CDDD92725E4997CB0878BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_crl_sign_not_set: 
- [historical] error e_ca_key_cert_sign_not_set: 
- [historical] error e_ca_key_usage_missing: 
- [historical] error e_ext_key_usage_without_bits: 
- [historical] fatal e_incorrect_ku_encoding: KeyUsage encodings must be at least four bytes long. Got 1 bytes
- [historical] error e_key_usage_incorrect_length: the key usage ([212]) extension is not parseable.
- [historical] error e_path_len_constraint_improperly_included: 
- [historical] error e_sub_cert_not_is_ca: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing AOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing AOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000027C7DEAF47D6C012FE000000000027
- SHA-256: 2AF3B34A5FD0EDC546E2E714208B6C380A5D5C553EDCA3A306A9E442C2389AAE
- SPKI SHA-256: F19A176BC779C77609427F441B995F14CAB9A19D87CDDD92725E4997CB0878BC
- Validity: 2021-03-11 to 2026-03-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:27:c7:de:af:47:d6:c0:12:fe:00:00:00:00:00:27
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:00 2021 GMT
            Not After : Mar 11 21:46:00 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing AOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                8A:96:C2:81:0D:57:8A:42:CE:30:F9:B8:C1:9D:0C:1E:53:A6:4F:E5
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2AF3B34A5FD0EDC546E2E714208B6C380A5D5C553EDCA3A306A9E442C2389AAE
    SPKI SHA256: F19A176BC779C77609427F441B995F14CAB9A19D87CDDD92725E4997CB0878BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing EOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000310C4914B18C8F339A000000000031
- SHA-256: 5EA3857EACD4C7CA5ACBCA9C4627E26F3072038D191A29D4C3F9464B2E5F00C6
- SPKI SHA-256: 1F1D8E7685CE8255088F791BFD3FB927F50AC1007091B5BBC3347EFBC5D9A80C
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20rsa%20tls%20issuing%20eoc%20ca%2001.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:31:0c:49:14:b1:8c:8f:33:9a:00:00:00:00:00:31
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:57:39 2021 GMT
            Not After : Jun 24 20:57:39 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing EOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                73:08:78:93:F9:D5:A9:9C:A3:77:7E:11:34:74:FF:45:32:71:B7:83
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5EA3857EACD4C7CA5ACBCA9C4627E26F3072038D191A29D4C3F9464B2E5F00C6
    SPKI SHA256: 1F1D8E7685CE8255088F791BFD3FB927F50AC1007091B5BBC3347EFBC5D9A80C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing EOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000289B1BE7B00F974391000000000028
- SHA-256: E204F2682F5F630E360256ABD722DFF475432053128FC4274649F65D14EE1A36
- SPKI SHA-256: 1F1D8E7685CE8255088F791BFD3FB927F50AC1007091B5BBC3347EFBC5D9A80C
- Validity: 2021-03-11 to 2026-03-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:28:9b:1b:e7:b0:0f:97:43:91:00:00:00:00:00:28
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:01 2021 GMT
            Not After : Mar 11 21:46:01 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing EOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                73:08:78:93:F9:D5:A9:9C:A3:77:7E:11:34:74:FF:45:32:71:B7:83
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E204F2682F5F630E360256ABD722DFF475432053128FC4274649F65D14EE1A36
    SPKI SHA256: 1F1D8E7685CE8255088F791BFD3FB927F50AC1007091B5BBC3347EFBC5D9A80C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing EOC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000002D5F3DF82A896D6A3F00000000002D
- SHA-256: EB79C04645B9137E67647A7389DAC6EB1D3AAD8AA74D8994AA8F9C01015ECDE0
- SPKI SHA-256: 1F1D8E7685CE8255088F791BFD3FB927F50AC1007091B5BBC3347EFBC5D9A80C
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2d:5f:3d:f8:2a:89:6d:6a:3f:00:00:00:00:00:2d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:03:32 2021 GMT
            Not After : Jun 24 20:03:32 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing EOC CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                .
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                73:08:78:93:F9:D5:A9:9C:A3:77:7E:11:34:74:FF:45:32:71:B7:83
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EB79C04645B9137E67647A7389DAC6EB1D3AAD8AA74D8994AA8F9C01015ECDE0
    SPKI SHA256: 1F1D8E7685CE8255088F791BFD3FB927F50AC1007091B5BBC3347EFBC5D9A80C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_crl_sign_not_set: 
- [historical] error e_ca_key_cert_sign_not_set: 
- [historical] error e_ca_key_usage_missing: 
- [historical] error e_ext_key_usage_without_bits: 
- [historical] fatal e_incorrect_ku_encoding: KeyUsage encodings must be at least four bytes long. Got 1 bytes
- [historical] error e_key_usage_incorrect_length: the key usage ([212]) extension is not parseable.
- [historical] error e_path_len_constraint_improperly_included: 
- [historical] error e_sub_cert_not_is_ca: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing EOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000029D905146635D54EBD000000000029
- SHA-256: C97634113A97DFD13D516B9B7FA1B886635C725BDF70BC0A7891DF8E3FF0F91C
- SPKI SHA-256: 89E1EF9BD893880FCA4C2D0BA71EC93DAF6C0AC14D5A9996F3E16F9763995076
- Validity: 2021-03-11 to 2026-03-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:29:d9:05:14:66:35:d5:4e:bd:00:00:00:00:00:29
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Mar 11 21:46:02 2021 GMT
            Not After : Mar 11 21:46:02 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing EOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C9:84:96:38:73:A6:2E:4B:18:6A:6D:44:D5:94:A3:7D:34:A6:C7:F7
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C97634113A97DFD13D516B9B7FA1B886635C725BDF70BC0A7891DF8E3FF0F91C
    SPKI SHA256: 89E1EF9BD893880FCA4C2D0BA71EC93DAF6C0AC14D5A9996F3E16F9763995076
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: -
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing EOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000032444D7521341496A9000000000032
- SHA-256: 4D55BC4ABEB7D37FAB57E573ACCE83133E36212C864E003FBCB30B5FC248B011
- SPKI SHA-256: 89E1EF9BD893880FCA4C2D0BA71EC93DAF6C0AC14D5A9996F3E16F9763995076
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/microsoft%20rsa%20tls%20issuing%20eoc%20ca%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:32:44:4d:75:21:34:14:96:a9:00:00:00:00:00:32
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:57:40 2021 GMT
            Not After : Jun 24 20:57:40 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing EOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C9:84:96:38:73:A6:2E:4B:18:6A:6D:44:D5:94:A3:7D:34:A6:C7:F7
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4D55BC4ABEB7D37FAB57E573ACCE83133E36212C864E003FBCB30B5FC248B011
    SPKI SHA256: 89E1EF9BD893880FCA4C2D0BA71EC93DAF6C0AC14D5A9996F3E16F9763995076
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft RSA TLS Issuing EOC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA TLS Issuing EOC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000002E99DB07378D0F00B600000000002E
- SHA-256: 3B7D95D4FF780B5EA537D852E24C5485CDA83B2B7931C7AF1C8FEEC9C62146DB
- SPKI SHA-256: 89E1EF9BD893880FCA4C2D0BA71EC93DAF6C0AC14D5A9996F3E16F9763995076
- Validity: 2021-06-24 to 2026-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:2e:99:db:07:37:8d:0f:00:b6:00:00:00:00:00:2e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jun 24 20:03:34 2021 GMT
            Not After : Jun 24 20:03:34 2026 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft RSA TLS Issuing EOC CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                .
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C9:84:96:38:73:A6:2E:4B:18:6A:6D:44:D5:94:A3:7D:34:A6:C7:F7
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3B7D95D4FF780B5EA537D852E24C5485CDA83B2B7931C7AF1C8FEEC9C62146DB
    SPKI SHA256: 89E1EF9BD893880FCA4C2D0BA71EC93DAF6C0AC14D5A9996F3E16F9763995076
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: Ô
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_crl_sign_not_set: 
- [historical] error e_ca_key_cert_sign_not_set: 
- [historical] error e_ca_key_usage_missing: 
- [historical] error e_ext_key_usage_without_bits: 
- [historical] fatal e_incorrect_ku_encoding: KeyUsage encodings must be at least four bytes long. Got 1 bytes
- [historical] error e_key_usage_incorrect_length: the key usage ([212]) extension is not parseable.
- [historical] error e_path_len_constraint_improperly_included: 
- [historical] error e_sub_cert_not_is_ca: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft Server PCA 2018

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft Server PCA 2018
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000000288E358F4E2074B99000000000002
- SHA-256: 334AF3B6768A869399DE242079038D21D1FDA5B9865708D7427F7F675D588B43
- SPKI SHA-256: FCCD99F06DDB479457134467C4E8C178A7855C04F7890EF2C5BD1B5E972F711F
- Validity: 2018-02-28 to 2033-02-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:02:88:e3:58:f4:e2:07:4b:99:00:00:00:00:00:02
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Feb 28 21:54:48 2018 GMT
            Not After : Feb 28 22:04:48 2033 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft Server PCA 2018
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                0D:FB:9D:55:C2:F8:10:FF:BA:0A:6F:79:77:6C:F0:B9:F2:F5:C8:F2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                Policy: 1.3.6.1.4.1.311.76.509.1.1
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 334AF3B6768A869399DE242079038D21D1FDA5B9865708D7427F7F675D588B43
    SPKI SHA256: FCCD99F06DDB479457134467C4E8C178A7855C04F7890EF2C5BD1B5E972F711F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0, 1.3.6.1.4.1.311.76.509.1.1
- AIA OCSP: -
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Microsoft TLS ECC EV Issuing CA 01

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC EV Issuing CA 01
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 3300000003B5E464B87F90C883000000000003
- SHA-256: DBED47A27D2DF69AF759EAD788D33BDD7BEE79A33D3B762A7806FFCFB3A3ACB4
- SPKI SHA-256: 0A4243C23FEA86296E80FE08CD18A41C04644F851E8BCEE053BC3909F5B9A9A1
- Validity: 2018-05-31 to 2023-05-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:03:b5:e4:64:b8:7f:90:c8:83:00:00:00:00:00:03
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:48:39 2018 GMT
            Not After : May 31 20:48:39 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft TLS ECC EV Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                A4:B6:58:07:40:15:79:0F:61:12:A1:38:7B:58:83:AA:7F:2F:F4:53
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DBED47A27D2DF69AF759EAD788D33BDD7BEE79A33D3B762A7806FFCFB3A3ACB4
    SPKI SHA256: 0A4243C23FEA86296E80FE08CD18A41C04644F851E8BCEE053BC3909F5B9A9A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC EV Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 330000000C809DBD4719B9873000000000000C
- SHA-256: F0F331FEC03AC7C3815560A62DDA5FC3364ECB8D5CEAE1D2BBE4AE50014E2C51
- SPKI SHA-256: F96277A8F02920BF6ADCBA927A6DD5D410CA358DE32DF3C69247DE4FFBE50F7D
- Validity: 2019-05-14 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0c:80:9d:bd:47:19:b9:87:30:00:00:00:00:00:0c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:05:03 2019 GMT
            Not After : May 14 21:05:03 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS ECC EV Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                31:D5:2D:BD:9D:25:DF:63:79:9B:53:DA:3F:F8:60:93:F6:B0:AB:BF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F0F331FEC03AC7C3815560A62DDA5FC3364ECB8D5CEAE1D2BBE4AE50014E2C51
    SPKI SHA256: F96277A8F02920BF6ADCBA927A6DD5D410CA358DE32DF3C69247DE4FFBE50F7D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC EV Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 33000000081B8CDADDB6EE2B45000000000008
- SHA-256: FE56029F3BBD0425F240A29AA163E26AD5180C96F71B3D7FC178BE541C4D2144
- SPKI SHA-256: 6176FBD5F8D62FE4B3073DD3BD5DFD028CD47A73D8E5BBA6DC89D4A2434CCB02
- Validity: 2019-06-11 to 2024-06-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:08:1b:8c:da:dd:b6:ee:2b:45:00:00:00:00:00:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 11 21:52:27 2019 GMT
            Not After : Jun 11 21:52:27 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS ECC EV Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                7C:9A:9D:3B:65:6C:61:9A:37:FA:C0:7B:A0:3C:C8:E9:25:79:2B:18
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FE56029F3BBD0425F240A29AA163E26AD5180C96F71B3D7FC178BE541C4D2144
    SPKI SHA256: 6176FBD5F8D62FE4B3073DD3BD5DFD028CD47A73D8E5BBA6DC89D4A2434CCB02
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC EV Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 330000000A0FBCE38F00264B3300000000000A
- SHA-256: 8D0C9827A6B044F0FF44EFFA154F4CFACCB1E82CDABCAAD0EF7225552F86EA25
- SPKI SHA-256: 6176FBD5F8D62FE4B3073DD3BD5DFD028CD47A73D8E5BBA6DC89D4A2434CCB02
- Validity: 2019-07-25 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0a:0f:bc:e3:8f:00:26:4b:33:00:00:00:00:00:0a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:34:26 2019 GMT
            Not After : May 14 17:34:26 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS ECC EV Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ..>...m.\..z._..C...'
            X509v3 Subject Key Identifier:
                7C:9A:9D:3B:65:6C:61:9A:37:FA:C0:7B:A0:3C:C8:E9:25:79:2B:18
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8D0C9827A6B044F0FF44EFFA154F4CFACCB1E82CDABCAAD0EF7225552F86EA25
    SPKI SHA256: 6176FBD5F8D62FE4B3073DD3BD5DFD028CD47A73D8E5BBA6DC89D4A2434CCB02
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 05

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 05
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 3300000004F61DD46A694AFE86000000000004
- SHA-256: 664E415A2473015216BAEB56708271BCE20277E93B398C5332DDD8B94C808327
- SPKI SHA-256: F631F7167F0DBA408B529E90AABAC5C3D139FAE88EF9B0F796A807EFD5E98022
- Validity: 2018-05-31 to 2023-05-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:04:f6:1d:d4:6a:69:4a:fe:86:00:00:00:00:00:04
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:48:40 2018 GMT
            Not After : May 31 20:48:40 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC EV Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                45:01:51:9E:B3:64:C2:45:A7:CA:12:0C:B0:29:5F:82:3B:61:5E:10
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 664E415A2473015216BAEB56708271BCE20277E93B398C5332DDD8B94C808327
    SPKI SHA256: F631F7167F0DBA408B529E90AABAC5C3D139FAE88EF9B0F796A807EFD5E98022
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 33000000091F7F3773EA9D4699000000000009
- SHA-256: F6CDE4876FEE5048124C05199485693184318D6C1DA82EBF234A5DD70FC0A859
- SPKI SHA-256: 10B8F5A60C23600C7F78FD6B11CB0A9BDA0D329F88F784EE6238FDA6CC776EFB
- Validity: 2019-06-11 to 2024-06-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:09:1f:7f:37:73:ea:9d:46:99:00:00:00:00:00:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Jun 11 21:52:28 2019 GMT
            Not After : Jun 11 21:52:28 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC EV Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                FD:22:F2:C6:30:18:1A:CF:58:43:A0:77:36:DD:64:88:BA:3D:B7:B4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F6CDE4876FEE5048124C05199485693184318D6C1DA82EBF234A5DD70FC0A859
    SPKI SHA256: 10B8F5A60C23600C7F78FD6B11CB0A9BDA0D329F88F784EE6238FDA6CC776EFB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV ECC Root Certificate Authority 2017
- Serial: 330000000B854D7E490E80DC9E00000000000B
- SHA-256: 4B5EE4FA66A0A53AE31B8F359F2CDF5B607B8ADB8098AD68CBCC03A8641BB47D
- SPKI SHA-256: 10B8F5A60C23600C7F78FD6B11CB0A9BDA0D329F88F784EE6238FDA6CC776EFB
- Validity: 2019-07-25 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0b:85:4d:7e:49:0e:80:dc:9e:00:00:00:00:00:0b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV ECC Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:34:27 2019 GMT
            Not After : May 14 17:34:27 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC EV Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ....GEN.T^...c.....q.[
            X509v3 Subject Key Identifier:
                FD:22:F2:C6:30:18:1A:CF:58:43:A0:77:36:DD:64:88:BA:3D:B7:B4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                63:E7:F4:E0:22:0A:CC:B0:16:CF:B4:3F:06:F5:83:F0:DF:F9:5B:91
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4B5EE4FA66A0A53AE31B8F359F2CDF5B607B8ADB8098AD68CBCC03A8641BB47D
    SPKI SHA256: 10B8F5A60C23600C7F78FD6B11CB0A9BDA0D329F88F784EE6238FDA6CC776EFB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC EV Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC EV Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 330000000D82C7FC5B670FE33100000000000D
- SHA-256: 911839E52426F245D7C80108B38D1AFCB887EF7EDAC1C1B2342773893BB7744A
- SPKI SHA-256: DDBE8172823F2E3DA99851C4774638788A82C4B48C0838D5ADEA394F49338D73
- Validity: 2019-05-14 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0d:82:c7:fc:5b:67:0f:e3:31:00:00:00:00:00:0d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:05:05 2019 GMT
            Not After : May 14 21:05:05 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC EV Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                4D:B4:9B:1A:53:42:27:3A:46:DE:ED:95:BA:53:7D:7C:4C:F7:EB:85
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 911839E52426F245D7C80108B38D1AFCB887EF7EDAC1C1B2342773893BB7744A
    SPKI SHA256: DDBE8172823F2E3DA99851C4774638788A82C4B48C0838D5ADEA394F49338D73
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC Issuing CA 01

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Issuing CA 01
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 3300000003239617A331584C3B000000000003
- SHA-256: A383B4A775AB1DF5E3E88507001CCC35352F44BC82E46694453FBF50406B4F6C
- SPKI SHA-256: A3642729B029153F4F11362A464F7E9D32D822D410F95A5C9F5C6B6D5C36A4D4
- Validity: 2018-05-31 to 2023-05-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:03:23:96:17:a3:31:58:4c:3b:00:00:00:00:00:03
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:43:57 2018 GMT
            Not After : May 31 20:43:57 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft TLS ECC Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                A2:99:93:F2:AB:6B:74:2A:64:A8:F3:57:46:F2:2E:CE:AA:98:AA:EE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A383B4A775AB1DF5E3E88507001CCC35352F44BC82E46694453FBF50406B4F6C
    SPKI SHA256: A3642729B029153F4F11362A464F7E9D32D822D410F95A5C9F5C6B6D5C36A4D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000000A821726907135A3F600000000000A
- SHA-256: 66CDEC7469C47EBCA67B1B72B858B209FAA890C043FC0BF201011B04D8E6E258
- SPKI SHA-256: 196098665C3C98836B0694B5526EF2DC91262256ACC42E84007F547E193C03AD
- Validity: 2019-05-14 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0a:82:17:26:90:71:35:a3:f6:00:00:00:00:00:0a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:18:52 2019 GMT
            Not After : May 14 21:18:52 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS ECC Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                10:A2:1D:B6:76:B1:0F:AF:B5:66:47:1D:9D:93:25:BA:98:35:A8:48
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 66CDEC7469C47EBCA67B1B72B858B209FAA890C043FC0BF201011B04D8E6E258
    SPKI SHA256: 196098665C3C98836B0694B5526EF2DC91262256ACC42E84007F547E193C03AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS ECC Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000001425815B5CB1CCE0C1000000000014
- SHA-256: 438D21B4BB0CEA3B7450A9447315B5A5451FF7D1E5B91F27A7EB3149566A5DB6
- SPKI SHA-256: 196098665C3C98836B0694B5526EF2DC91262256ACC42E84007F547E193C03AD
- Validity: 2019-07-25 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:14:25:81:5b:5c:b1:cc:e0:c1:00:00:00:00:00:14
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:39:39 2019 GMT
            Not After : May 14 17:39:39 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS ECC Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ..t X.hQ.u.RV..7'.F.7s
            X509v3 Subject Key Identifier:
                10:A2:1D:B6:76:B1:0F:AF:B5:66:47:1D:9D:93:25:BA:98:35:A8:48
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 438D21B4BB0CEA3B7450A9447315B5A5451FF7D1E5B91F27A7EB3149566A5DB6
    SPKI SHA256: 196098665C3C98836B0694B5526EF2DC91262256ACC42E84007F547E193C03AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC Issuing CA 05

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC Issuing CA 05
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 33000000048C754D11C3A19412000000000004
- SHA-256: CA61A36F29960ACE59951F7CCEF46E1368FAAE5EB3D6C06284CAE56E0918D7F7
- SPKI SHA-256: 875B1351A7CC7C1A0B32F9E45FEFEFF7888609A55AB70CE89A907F631E1C72CF
- Validity: 2018-05-31 to 2023-05-31
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:04:8c:75:4d:11:c3:a1:94:12:00:00:00:00:00:04
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:43:58 2018 GMT
            Not After : May 31 20:43:58 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                F3:85:7B:C6:34:F8:E5:02:01:2C:4C:29:8B:10:AA:27:24:7D:2F:B9
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CA61A36F29960ACE59951F7CCEF46E1368FAAE5EB3D6C06284CAE56E0918D7F7
    SPKI SHA256: 875B1351A7CC7C1A0B32F9E45FEFEFF7888609A55AB70CE89A907F631E1C72CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000000BC3416D6211DC9D2A00000000000B
- SHA-256: 702ACCF70DD6E09E194CAA10B395A81C56BB01FB1D06E7F137EA46E89AA12646
- SPKI SHA-256: B26BB68BE1B9A56583D28996986BAF5E7F52056786836FDD25E09448759A2427
- Validity: 2019-05-14 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0b:c3:41:6d:62:11:dc:9d:2a:00:00:00:00:00:0b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:18:53 2019 GMT
            Not After : May 14 21:18:53 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                8C:DE:08:E7:6A:95:5A:FF:DE:5F:92:8F:9D:21:B4:1D:93:08:6D:16
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 702ACCF70DD6E09E194CAA10B395A81C56BB01FB1D06E7F137EA46E89AA12646
    SPKI SHA256: B26BB68BE1B9A56583D28996986BAF5E7F52056786836FDD25E09448759A2427
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS ECC Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS ECC Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 3300000015889C316A4742299A000000000015
- SHA-256: 1CC9E4F7A05717BC1FDCC05245A1F677E840C8B317E35D7765CC41450B813961
- SPKI SHA-256: B26BB68BE1B9A56583D28996986BAF5E7F52056786836FDD25E09448759A2427
- Validity: 2019-07-25 to 2024-05-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:15:88:9c:31:6a:47:42:29:9a:00:00:00:00:00:15
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:39:40 2019 GMT
            Not After : May 14 17:39:40 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS ECC Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                .....7....P.....A...
3
            X509v3 Subject Key Identifier:
                8C:DE:08:E7:6A:95:5A:FF:DE:5F:92:8F:9D:21:B4:1D:93:08:6D:16
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1CC9E4F7A05717BC1FDCC05245A1F677E840C8B317E35D7765CC41450B813961
    SPKI SHA256: B26BB68BE1B9A56583D28996986BAF5E7F52056786836FDD25E09448759A2427
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS EV Issuing CA 01

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS EV Issuing CA 01
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 3300000006FE1EFED7BC72467E000000000006
- SHA-256: 4E8CF75CEC298A40011EC6F345A1B0801DAA7F13D4F6DF1F1C8807DC92D0D437
- SPKI SHA-256: 0EAAA2AA68794B27C9722ABC5F3041F62D3D1E364A038852321179AD937BA2B9
- Validity: 2018-05-31 to 2023-05-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:06:fe:1e:fe:d7:bc:72:46:7e:00:00:00:00:00:06
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:53:00 2018 GMT
            Not After : May 31 20:53:00 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft TLS EV Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                EE:BE:C6:1E:71:0C:EB:27:B8:D2:37:C4:75:AD:6F:68:2E:D7:9F:C8
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4E8CF75CEC298A40011EC6F345A1B0801DAA7F13D4F6DF1F1C8807DC92D0D437
    SPKI SHA256: 0EAAA2AA68794B27C9722ABC5F3041F62D3D1E364A038852321179AD937BA2B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS EV Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS EV Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 330000000EE7E0958C8A43FC9000000000000E
- SHA-256: 623A0D3C6E325795AADAA36599301AFD90392F46519F5B238FBE22936BBD5CCC
- SPKI SHA-256: EF0240256C6490A92298B5433664B334FCCACA07AF805C63B28B832E9631EFC7
- Validity: 2019-05-14 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0e:e7:e0:95:8c:8a:43:fc:90:00:00:00:00:00:0e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:05:08 2019 GMT
            Not After : May 14 21:05:08 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS EV Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                B0:BE:D2:69:DA:1B:2A:FE:B7:45:0B:1A:22:F1:E9:5A:09:99:78:6C
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 623A0D3C6E325795AADAA36599301AFD90392F46519F5B238FBE22936BBD5CCC
    SPKI SHA256: EF0240256C6490A92298B5433664B334FCCACA07AF805C63B28B832E9631EFC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS EV Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS EV Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 33000000101765FC11EB5F4B26000000000010
- SHA-256: 233897AA0E4C3CC09BBE816AA90023498A909E0F53989455DBC6FEEC35E08CE5
- SPKI SHA-256: EF0240256C6490A92298B5433664B334FCCACA07AF805C63B28B832E9631EFC7
- Validity: 2019-07-25 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:10:17:65:fc:11:eb:5f:4b:26:00:00:00:00:00:10
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:26:25 2019 GMT
            Not After : May 14 17:26:25 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS EV Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                .....Z...e>S...p ..+.?
            X509v3 Subject Key Identifier:
                B0:BE:D2:69:DA:1B:2A:FE:B7:45:0B:1A:22:F1:E9:5A:09:99:78:6C
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 233897AA0E4C3CC09BBE816AA90023498A909E0F53989455DBC6FEEC35E08CE5
    SPKI SHA256: EF0240256C6490A92298B5433664B334FCCACA07AF805C63B28B832E9631EFC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS EV Issuing CA 05

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS EV Issuing CA 05
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 3300000007953BF3A95F910755000000000007
- SHA-256: 190EE6BE09B3C97C1167DFD7BB366FE40C066F188A6DEFB1E0655A3F700341B1
- SPKI SHA-256: 3A7EFCAD147A63CD1AF903FEF7AACD206CEA3DCD3965EAF5AA8C4133F4FE7915
- Validity: 2018-05-31 to 2023-05-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:07:95:3b:f3:a9:5f:91:07:55:00:00:00:00:00:07
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:53:01 2018 GMT
            Not After : May 31 20:53:01 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS EV Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                A8:6D:FB:71:CC:90:D3:42:38:32:6C:E4:4B:D8:49:C1:09:78:39:19
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 190EE6BE09B3C97C1167DFD7BB366FE40C066F188A6DEFB1E0655A3F700341B1
    SPKI SHA256: 3A7EFCAD147A63CD1AF903FEF7AACD206CEA3DCD3965EAF5AA8C4133F4FE7915
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS EV Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS EV Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 330000000FEBE2B7FD288667A300000000000F
- SHA-256: 3218B4D05A677CAC5ED6DD2C96A7B78C0C3938F4B1EC3B4B2131B53F39A01D0E
- SPKI SHA-256: C4471E473CD30DCBA87127BAC4F9F4AF6F6478E0C614F25CE258BCADC293BD3B
- Validity: 2019-05-14 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0f:eb:e2:b7:fd:28:86:67:a3:00:00:00:00:00:0f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:05:09 2019 GMT
            Not After : May 14 21:05:09 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS EV Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                9F:54:55:D7:84:14:A7:5E:5B:52:1A:81:E3:E1:BD:AE:D7:7A:CB:8E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3218B4D05A677CAC5ED6DD2C96A7B78C0C3938F4B1EC3B4B2131B53F39A01D0E
    SPKI SHA256: C4471E473CD30DCBA87127BAC4F9F4AF6F6478E0C614F25CE258BCADC293BD3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS EV Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS EV Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft EV RSA Root Certificate Authority 2017
- Serial: 330000001127CBE118C4847C71000000000011
- SHA-256: 918410E5EFF9905737393889421F4145A273DB26A3871F462CB759130E45DD6E
- SPKI SHA-256: C4471E473CD30DCBA87127BAC4F9F4AF6F6478E0C614F25CE258BCADC293BD3B
- Validity: 2019-07-25 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:11:27:cb:e1:18:c4:84:7c:71:00:00:00:00:00:11
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft EV RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:26:26 2019 GMT
            Not After : May 14 17:26:26 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS EV Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ..V....#...nI$m.m..b..
            X509v3 Subject Key Identifier:
                9F:54:55:D7:84:14:A7:5E:5B:52:1A:81:E3:E1:BD:AE:D7:7A:CB:8E
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                41:CA:FF:16:B2:09:4E:DC:24:C8:4B:E4:5C:16:25:99:F8:26:EF:3B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 918410E5EFF9905737393889421F4145A273DB26A3871F462CB759130E45DD6E
    SPKI SHA256: C4471E473CD30DCBA87127BAC4F9F4AF6F6478E0C614F25CE258BCADC293BD3B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20EV%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS G1 ECC CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 ECC CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000003D136DEBEF4C351D1200000000003D
- SHA-256: 2B5F1CA6E115D42112224720694D73BA50CA9B5C64E9DA2529B8F4AAF38DF384
- SPKI SHA-256: A78525848FB820D764D473ECF3E41D794F71153CC8C21F2DBB055A55CBA801D8
- Validity: 2025-08-28 to 2030-08-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2001_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:3d:13:6d:eb:ef:4c:35:1d:12:00:00:00:00:00:3d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Aug 28 21:50:35 2025 GMT
            Not After : Aug 28 21:50:35 2030 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G1 ECC CA 01
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                7C:AA:C9:A9:DD:D1:AF:D8:F4:D2:41:61:57:2F:4B:F8:D3:6E:5D:0E
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2B5F1CA6E115D42112224720694D73BA50CA9B5C64E9DA2529B8F4AAF38DF384
    SPKI SHA256: A78525848FB820D764D473ECF3E41D794F71153CC8C21F2DBB055A55CBA801D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G1 ECC CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 ECC CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft ECC Root Certificate Authority 2017
- Serial: 330000003C7D4B4D2574A8855B00000000003C
- SHA-256: C8201D6406020821C00855E25CF826983BBD143F074935F440FB3BF980A2F90A
- SPKI SHA-256: 5BE526C371D87C83B357D6F12B3A1641C51F4F94AC8F94ADD129508316165D52
- Validity: 2025-08-28 to 2030-08-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20ECC%20CA%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:3c:7d:4b:4d:25:74:a8:85:5b:00:00:00:00:00:3c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft ECC Root Certificate Authority 2017
        Validity
            Not Before: Aug 28 21:50:34 2025 GMT
            Not After : Aug 28 21:50:34 2030 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G1 ECC CA 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                5B:38:1B:7E:AC:1C:C5:B3:35:DC:4D:1A:66:12:B3:21:5F:A5:4C:C7
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C8:CB:99:72:70:52:0C:F8:E6:BE:B2:04:57:29:2A:CF:42:10:ED:35
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C8201D6406020821C00855E25CF826983BBD143F074935F440FB3BF980A2F90A
    SPKI SHA256: 5BE526C371D87C83B357D6F12B3A1641C51F4F94AC8F94ADD129508316165D52
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G1 RSA CA 01

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 01
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000044E807BA6918AB9AE4000000000044
- SHA-256: 79DBA0721F6DC1AD8EDC3DC27518702F970044188928BF7E8B42A04531424F73
- SPKI SHA-256: 159F69C9B6EECA7F47869191D4D3ED856B27CE456142643340BCAC85ED986102
- Validity: 2025-08-28 to 2030-08-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2001_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:44:e8:07:ba:69:18:ab:9a:e4:00:00:00:00:00:44
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Aug 28 21:51:05 2025 GMT
            Not After : Aug 28 21:51:05 2030 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G1 RSA CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                20:BB:F2:19:8E:A4:C6:72:B4:AA:C9:04:41:6F:55:9A:A6:9F:3D:0F
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 79DBA0721F6DC1AD8EDC3DC27518702F970044188928BF7E8B42A04531424F73
    SPKI SHA256: 159F69C9B6EECA7F47869191D4D3ED856B27CE456142643340BCAC85ED986102
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G1 RSA CA 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000453BFFDCDACA3EFD32000000000045
- SHA-256: 04396B0ED932A93150457013D839077784BFB143EA900B6A4990FCA139CBD4D1
- SPKI SHA-256: 5F3B40B1E710CF3C6ED6352FD566CBCB823E45DF24F76D1E4BA26D85B84117BC
- Validity: 2025-08-28 to 2030-08-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2002.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:45:3b:ff:dc:da:ca:3e:fd:32:00:00:00:00:00:45
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Aug 28 21:51:06 2025 GMT
            Not After : Aug 28 21:51:06 2030 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G1 RSA CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C3:D4:06:3C:D3:1A:48:10:90:32:35:86:28:D3:94:8C:71:2A:D7:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 04396B0ED932A93150457013D839077784BFB143EA900B6A4990FCA139CBD4D1
    SPKI SHA256: 5F3B40B1E710CF3C6ED6352FD566CBCB823E45DF24F76D1E4BA26D85B84117BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G1 RSA CA 03

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 03
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000465C83326B083F339E000000000046
- SHA-256: 8797D4D4A3473CA1D86A279BED9639937B27C52F3CDA0B6009D695BC373BDEBB
- SPKI SHA-256: 0F608AE5892BB47E9D25A8C7C4B47E3FA24E9C22252B84CE452E3FD3B066300F
- Validity: 2025-08-28 to 2030-08-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00001.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00002.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00003.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00004.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00005.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00006.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00007.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00008.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00009.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00010.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00011.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00012.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00013.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00014.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00015.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00016.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00017.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00018.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00019.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00020.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00021.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00022.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00023.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00024.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00025.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00026.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00027.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00028.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00029.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00030.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00031.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00032.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00033.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00034.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00035.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00036.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00037.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00038.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00039.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00040.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00041.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00042.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00043.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00044.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00045.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00046.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00047.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00048.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00049.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00050.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00051.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00052.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00053.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00054.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00055.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00056.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00057.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00058.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00059.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00060.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00061.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00062.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00063.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00064.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00065.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00066.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00067.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00068.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00069.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00070.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00071.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00072.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00073.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00074.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00075.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00076.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00077.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00078.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00079.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00080.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00081.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00082.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00083.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00084.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00085.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00086.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00087.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00088.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00089.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00090.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00091.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00092.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00093.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00094.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00095.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00096.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00097.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00098.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00099.crl, http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2003_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:46:5c:83:32:6b:08:3f:33:9e:00:00:00:00:00:46
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Aug 28 21:51:07 2025 GMT
            Not After : Aug 28 21:51:07 2030 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G1 RSA CA 03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                BC:CB:C8:BC:0D:56:23:C1:E6:AF:CA:87:D5:6B:7A:CE:C6:62:CC:EB
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8797D4D4A3473CA1D86A279BED9639937B27C52F3CDA0B6009D695BC373BDEBB
    SPKI SHA256: 0F608AE5892BB47E9D25A8C7C4B47E3FA24E9C22252B84CE452E3FD3B066300F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G1 RSA CA 04

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G1 RSA CA 04
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000477A82567E021DB115000000000047
- SHA-256: 2765F456AA084CC2BA015C44D42EC783F2BF6E706C9132E8A6EFD3C800F32D93
- SPKI SHA-256: 0DA1FE05941CD2F0EFCC39F0218590A30F1594D1682523C74F812ABC0509967A
- Validity: 2025-08-28 to 2030-08-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20G1%20RSA%20CA%2004.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:47:7a:82:56:7e:02:1d:b1:15:00:00:00:00:00:47
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Aug 28 21:51:08 2025 GMT
            Not After : Aug 28 21:51:08 2030 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G1 RSA CA 04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                B5:C2:6D:72:E3:81:47:DE:C0:DD:A6:71:E4:55:77:88:A5:35:DC:9F
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2765F456AA084CC2BA015C44D42EC783F2BF6E706C9132E8A6EFD3C800F32D93
    SPKI SHA256: 0DA1FE05941CD2F0EFCC39F0218590A30F1594D1682523C74F812ABC0509967A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 ECC CA OCSP 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2
- Serial: 3300000005516A21C89814CCF7000000000005
- SHA-256: 8A7B34C8E82EFB3B5B416671230729FAD2E26279383FB2993ED2920BD6E21241
- SPKI SHA-256: 25FA9B443B06549AFBCAD74632396341047FA433F804F8334CCC7D10237616A3
- Validity: 2025-08-01 to 2029-06-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2002_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:05:51:6a:21:c8:98:14:cc:f7:00:00:00:00:00:05
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS ECC Root G2
        Validity
            Not Before: Aug  1 20:02:02 2025 GMT
            Not After : Jun  3 20:02:02 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 ECC CA OCSP 02
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                E5:1F:C4:6A:09:36:E2:AF:E1:64:6E:BD:FC:6B:E9:ED:C5:D0:2A:74
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:AB:7E:DA:FF:97:43:72:EC:3B:67:77:DE:82:61:35:88:47:42:85
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8A7B34C8E82EFB3B5B416671230729FAD2E26279383FB2993ED2920BD6E21241
    SPKI SHA256: 25FA9B443B06549AFBCAD74632396341047FA433F804F8334CCC7D10237616A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 ECC CA OCSP 04

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 04
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2
- Serial: 3300000008D690FFF489D9C4D7000000000008
- SHA-256: 36A52BC5A51CA90DF18A1BAFF92982301582A54C2BBE4F8D618D96D2E830A501
- SPKI SHA-256: FA5530B555993415D86D74D4FF0E4BF2402E5A3A0BD6FBE712761F4DD85AC4BC
- Validity: 2025-08-14 to 2029-06-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2004_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:08:d6:90:ff:f4:89:d9:c4:d7:00:00:00:00:00:08
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS ECC Root G2
        Validity
            Not Before: Aug 14 23:03:21 2025 GMT
            Not After : Jun  3 23:03:21 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 ECC CA OCSP 04
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                A4:49:AD:EE:02:30:A5:B8:B3:6C:37:98:2A:F0:3C:4E:E2:AD:B1:B2
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:AB:7E:DA:FF:97:43:72:EC:3B:67:77:DE:82:61:35:88:47:42:85
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 36A52BC5A51CA90DF18A1BAFF92982301582A54C2BBE4F8D618D96D2E830A501
    SPKI SHA256: FA5530B555993415D86D74D4FF0E4BF2402E5A3A0BD6FBE712761F4DD85AC4BC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 ECC CA OCSP 06

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 06
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2
- Serial: 33000000066FA24C31C3956FAB000000000006
- SHA-256: 27B122BC1DBE12C88B1ACBEBC33030BDBCCF4DE724EC8E82266513D0797C097A
- SPKI SHA-256: 7A67BFAF7BEA81570D0A5B96E46D34332A768A3893A9B0B91B90527FCCAB6324
- Validity: 2025-08-01 to 2029-06-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2006_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:06:6f:a2:4c:31:c3:95:6f:ab:00:00:00:00:00:06
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS ECC Root G2
        Validity
            Not Before: Aug  1 20:02:03 2025 GMT
            Not After : Jun  3 20:02:03 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 ECC CA OCSP 06
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                38:9B:2C:E5:9C:4F:9D:C2:14:61:EA:E9:44:10:8D:70:49:4B:EA:5B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:AB:7E:DA:FF:97:43:72:EC:3B:67:77:DE:82:61:35:88:47:42:85
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 27B122BC1DBE12C88B1ACBEBC33030BDBCCF4DE724EC8E82266513D0797C097A
    SPKI SHA256: 7A67BFAF7BEA81570D0A5B96E46D34332A768A3893A9B0B91B90527FCCAB6324
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 ECC CA OCSP 08

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 ECC CA OCSP 08
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS ECC Root G2
- Serial: 3300000007737DEB49D007DC64000000000007
- SHA-256: C72C4B58522EE034B49A26EE822BC4D67C8D348756C5BB373B6A2D7B821A97B0
- SPKI SHA-256: 705DD1EB7388BA45846BE085BFF42DF3EA593051B0D0626F53C132CA4E66679A
- Validity: 2025-08-14 to 2029-06-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20ECC%20CA%20OCSP%2008_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:07:73:7d:eb:49:d0:07:dc:64:00:00:00:00:00:07
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS ECC Root G2
        Validity
            Not Before: Aug 14 23:03:20 2025 GMT
            Not After : Jun  3 23:03:20 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 ECC CA OCSP 08
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                C3:A5:B3:FC:6C:D1:9B:84:88:4F:E6:92:91:F7:BE:F6:E5:0A:E2:05
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:AB:7E:DA:FF:97:43:72:EC:3B:67:77:DE:82:61:35:88:47:42:85
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C72C4B58522EE034B49A26EE822BC4D67C8D348756C5BB373B6A2D7B821A97B0
    SPKI SHA256: 705DD1EB7388BA45846BE085BFF42DF3EA593051B0D0626F53C132CA4E66679A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20ECC%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20ECC%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000C4964A16F44203B2200000000000C
- SHA-256: EA7A25255D111FC3CE4CB8FABE3ADF9C27BBE6DB203F955066BAB4C5A71F3D08
- SPKI SHA-256: 5F411B87D15FDC3C730F3DCD19AB922C52E23DEF01B327118E865B57EB0543C4
- Validity: 2025-08-01 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2002_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0c:49:64:a1:6f:44:20:3b:22:00:00:00:00:00:0c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug  1 20:03:00 2025 GMT
            Not After : Jun  3 20:03:00 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                B8:2F:33:A6:7C:51:4F:7F:1F:2D:D5:C8:15:42:38:A4:B2:0E:8F:2F
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EA7A25255D111FC3CE4CB8FABE3ADF9C27BBE6DB203F955066BAB4C5A71F3D08
    SPKI SHA256: 5F411B87D15FDC3C730F3DCD19AB922C52E23DEF01B327118E865B57EB0543C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 02

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 02
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000674997E55D8C5020D000000000006
- SHA-256: E4F93B694981068A6E07ADD2AFE050464B82F9276B96BA3ECF59817DDB6E1085
- SPKI SHA-256: 5F411B87D15FDC3C730F3DCD19AB922C52E23DEF01B327118E865B57EB0543C4
- Validity: 2025-06-26 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:06:74:99:7e:55:d8:c5:02:0d:00:00:00:00:00:06
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Jun 26 21:23:33 2025 GMT
            Not After : Jun  3 21:23:33 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                B8:2F:33:A6:7C:51:4F:7F:1F:2D:D5:C8:15:42:38:A4:B2:0E:8F:2F
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E4F93B694981068A6E07ADD2AFE050464B82F9276B96BA3ECF59817DDB6E1085
    SPKI SHA256: 5F411B87D15FDC3C730F3DCD19AB922C52E23DEF01B327118E865B57EB0543C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 04

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 04
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 33000000050717B5EE99E2F4DF000000000005
- SHA-256: 870A6F0B649FA5781A27710F50FBE1C5027E7B7DE000BE9D20D02C6791B96AC8
- SPKI SHA-256: 0A071DAA9E2D5B0696FF9CD54F44B33372556ABC11F6A673680A63805A9E5627
- Validity: 2025-06-26 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:05:07:17:b5:ee:99:e2:f4:df:00:00:00:00:00:05
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Jun 26 21:23:31 2025 GMT
            Not After : Jun  3 21:23:31 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                54:0C:BC:EC:18:F7:7D:F1:03:E2:84:BE:34:64:44:67:CF:75:1F:65
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 870A6F0B649FA5781A27710F50FBE1C5027E7B7DE000BE9D20D02C6791B96AC8
    SPKI SHA256: 0A071DAA9E2D5B0696FF9CD54F44B33372556ABC11F6A673680A63805A9E5627
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 04

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 04
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000B13E5667D4A9B558000000000000B
- SHA-256: AC8EA9F2874FD368A3E778B1A0B165EE898DB9B9687C17EDCDC76908AB58C82C
- SPKI SHA-256: 0A071DAA9E2D5B0696FF9CD54F44B33372556ABC11F6A673680A63805A9E5627
- Validity: 2025-08-01 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2004_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0b:13:e5:66:7d:4a:9b:55:80:00:00:00:00:00:0b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug  1 20:02:59 2025 GMT
            Not After : Jun  3 20:02:59 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 04
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                54:0C:BC:EC:18:F7:7D:F1:03:E2:84:BE:34:64:44:67:CF:75:1F:65
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AC8EA9F2874FD368A3E778B1A0B165EE898DB9B9687C17EDCDC76908AB58C82C
    SPKI SHA256: 0A071DAA9E2D5B0696FF9CD54F44B33372556ABC11F6A673680A63805A9E5627
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 06

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 06
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000DEF69CD2D7223735600000000000D
- SHA-256: 16B74B335C6F9801CFC499E39CC292F6D13C5191BE87126226403819DA4AD213
- SPKI SHA-256: E166F9AE60DB2AD1B851713A37C05AF83FF74EF9A8FB27B2DCC5FDDA2EEAF7F8
- Validity: 2025-08-01 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2006_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0d:ef:69:cd:2d:72:23:73:56:00:00:00:00:00:0d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug  1 20:03:01 2025 GMT
            Not After : Jun  3 20:03:01 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                0C:5D:6B:CD:4A:34:01:60:34:34:24:01:E0:3F:50:05:83:EB:A8:45
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 16B74B335C6F9801CFC499E39CC292F6D13C5191BE87126226403819DA4AD213
    SPKI SHA256: E166F9AE60DB2AD1B851713A37C05AF83FF74EF9A8FB27B2DCC5FDDA2EEAF7F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 06

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 06
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000710F17E5773D03D87000000000007
- SHA-256: 016CB2A68F7B7D96311306DB9648FA798C2C40BE1574AD12891549C99F41082E
- SPKI SHA-256: E166F9AE60DB2AD1B851713A37C05AF83FF74EF9A8FB27B2DCC5FDDA2EEAF7F8
- Validity: 2025-06-26 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:07:10:f1:7e:57:73:d0:3d:87:00:00:00:00:00:07
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Jun 26 21:23:35 2025 GMT
            Not After : Jun  3 21:23:35 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                0C:5D:6B:CD:4A:34:01:60:34:34:24:01:E0:3F:50:05:83:EB:A8:45
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 016CB2A68F7B7D96311306DB9648FA798C2C40BE1574AD12891549C99F41082E
    SPKI SHA256: E166F9AE60DB2AD1B851713A37C05AF83FF74EF9A8FB27B2DCC5FDDA2EEAF7F8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 08

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 08
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 3300000011F100A7EB05EBA100000000000011
- SHA-256: 885451307A4ABF298BB28ADD793EC7826629B057ECA79E6F51DC51F42CD64A2D
- SPKI SHA-256: CDF1A22CDEBD37D0705FE3D91918A7618F481AB84DD257F1912B6A4354404D5A
- Validity: 2025-08-14 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2008_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:11:f1:00:a7:eb:05:eb:a1:00:00:00:00:00:00:11
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug 14 23:03:40 2025 GMT
            Not After : Jun  3 23:03:40 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 08
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                0F:B2:32:80:ED:7F:8A:9C:00:84:38:E6:D8:D7:F6:70:85:77:ED:7A
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 885451307A4ABF298BB28ADD793EC7826629B057ECA79E6F51DC51F42CD64A2D
    SPKI SHA256: CDF1A22CDEBD37D0705FE3D91918A7618F481AB84DD257F1912B6A4354404D5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 10

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 10
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000F33206537EE42AE4F00000000000F
- SHA-256: 6EBFF927297A5B3AAF5EAE672252C36A5158473FA5BBF0E29508D5528358F83B
- SPKI SHA-256: 49B5187BCD0DE4F503DE386CA1AB3E09EAF1E23016329FEB29DE9D088FA0BB9A
- Validity: 2025-08-01 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2010_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0f:33:20:65:37:ee:42:ae:4f:00:00:00:00:00:0f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug  1 20:03:03 2025 GMT
            Not After : Jun  3 20:03:03 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 10
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                D0:4C:83:D1:8E:71:2E:3D:34:B1:FF:9B:79:2C:8E:74:D4:E2:78:06
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6EBFF927297A5B3AAF5EAE672252C36A5158473FA5BBF0E29508D5528358F83B
    SPKI SHA256: 49B5187BCD0DE4F503DE386CA1AB3E09EAF1E23016329FEB29DE9D088FA0BB9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 10

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 10
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 3300000008710CE4EAF0BCC488000000000008
- SHA-256: ECF249379A0C083CACE54EC906AE4550ECC634DA4A8262FEA7083ECB9E13FC39
- SPKI SHA-256: 49B5187BCD0DE4F503DE386CA1AB3E09EAF1E23016329FEB29DE9D088FA0BB9A
- Validity: 2025-06-26 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:08:71:0c:e4:ea:f0:bc:c4:88:00:00:00:00:00:08
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Jun 26 21:23:37 2025 GMT
            Not After : Jun  3 21:23:37 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 10
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                D0:4C:83:D1:8E:71:2E:3D:34:B1:FF:9B:79:2C:8E:74:D4:E2:78:06
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: ECF249379A0C083CACE54EC906AE4550ECC634DA4A8262FEA7083ECB9E13FC39
    SPKI SHA256: 49B5187BCD0DE4F503DE386CA1AB3E09EAF1E23016329FEB29DE9D088FA0BB9A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 12

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 12
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 33000000107D59860FD64D7243000000000010
- SHA-256: D9280DDA01FCDFE208955CC7FBEF27C3909C0A05D2C2E24E27DBB33C3BE5889C
- SPKI SHA-256: DD925FC18FC8488E844337327CA9E0F89BA4BF02013B38F391C1EF5904F464FF
- Validity: 2025-08-14 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2012_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:10:7d:59:86:0f:d6:4d:72:43:00:00:00:00:00:10
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug 14 23:03:39 2025 GMT
            Not After : Jun  3 23:03:39 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 12
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                31:A5:A5:89:43:EF:C7:AC:31:15:3E:48:7A:E3:06:C6:E9:ED:BC:2A
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D9280DDA01FCDFE208955CC7FBEF27C3909C0A05D2C2E24E27DBB33C3BE5889C
    SPKI SHA256: DD925FC18FC8488E844337327CA9E0F89BA4BF02013B38F391C1EF5904F464FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 14

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 14
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 33000000127E739347E75BE1A1000000000012
- SHA-256: B2ABE84672548695C111FF9A9D6D8D55EABABF2FC311D02ECF86A93CD7FCE361
- SPKI SHA-256: DAEE75C9D844A8FCF8ED80D25062CF84BAFFDEDCED62DC8F0683303D14A7E281
- Validity: 2025-08-14 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2014_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:12:7e:73:93:47:e7:5b:e1:a1:00:00:00:00:00:12
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug 14 23:03:41 2025 GMT
            Not After : Jun  3 23:03:41 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 14
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                52:68:F4:FA:12:56:E3:F6:D8:42:AF:30:0B:40:B8:39:23:F5:F7:2B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B2ABE84672548695C111FF9A9D6D8D55EABABF2FC311D02ECF86A93CD7FCE361
    SPKI SHA256: DAEE75C9D844A8FCF8ED80D25062CF84BAFFDEDCED62DC8F0683303D14A7E281
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 16

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 16
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 330000000E42938F25DC51A99B00000000000E
- SHA-256: 38D895F5105BC2545822C17A2444F4B0EA3D298D2C15A38296AA7295A3D85CE9
- SPKI SHA-256: 93C86719AF780A1EBC01F2952EA9E9C55C94420F8ACC2952E9FA0A45A73D1C8F
- Validity: 2025-08-01 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00001.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00001.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00002.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00002.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00003.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00003.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00004.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00004.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00005.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00005.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00006.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00006.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00007.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00007.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00008.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00008.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00009.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00009.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00010.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00010.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00011.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00011.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00012.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00012.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00013.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00013.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00014.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00014.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00015.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00015.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00016.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00016.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00017.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00017.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00018.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00018.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00019.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00019.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00020.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00020.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00021.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00021.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00022.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00022.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00023.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00023.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00024.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00024.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00025.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00025.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00026.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00026.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00027.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00027.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00028.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00028.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00029.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00029.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00030.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00030.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00031.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00031.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00032.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00032.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00033.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00033.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00034.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00034.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00035.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00035.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00036.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00036.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00037.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00037.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00038.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00038.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00039.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00039.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00040.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00040.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00041.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00041.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00042.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00042.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00043.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00043.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00044.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00044.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00045.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00045.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00046.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00046.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00047.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00047.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00048.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00048.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00049.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00049.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00050.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00050.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00051.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00051.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00052.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00052.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00053.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00053.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00054.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00054.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00055.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00055.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00056.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00056.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00057.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00057.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00058.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00058.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00059.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00059.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00060.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00060.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00061.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00061.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00062.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00062.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00063.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00063.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00064.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00064.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00065.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00065.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00066.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00066.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00067.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00067.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00068.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00068.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00069.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00069.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00070.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00070.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00071.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00071.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00072.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00072.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00073.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00073.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00074.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00074.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00075.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00075.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00076.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00076.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00077.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00077.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00078.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00078.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00079.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00079.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00080.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00080.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00081.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00081.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00082.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00082.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00083.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00083.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00084.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00084.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00085.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00085.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00086.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00086.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00087.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00087.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00088.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00088.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00089.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00089.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00090.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00090.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00091.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00091.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00092.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00092.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00093.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00093.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00094.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00094.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00095.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00095.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00096.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00096.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00097.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00097.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00098.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00098.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00099.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00099.crl, http://www.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00100.crl, http://crl2.microsoft.com/pkiops/crl/partition/Microsoft%20TLS%20G2%20RSA%20CA%20OCSP%2016_Partition00100.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0e:42:93:8f:25:dc:51:a9:9b:00:00:00:00:00:0e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Aug  1 20:03:02 2025 GMT
            Not After : Jun  3 20:03:02 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 16
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                06:39:F0:56:D1:ED:90:C8:36:A3:A0:0F:94:FE:62:94:A7:E6:FC:37
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 38D895F5105BC2545822C17A2444F4B0EA3D298D2C15A38296AA7295A3D85CE9
    SPKI SHA256: 93C86719AF780A1EBC01F2952EA9E9C55C94420F8ACC2952E9FA0A45A73D1C8F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS G2 RSA CA OCSP 16

- Subject: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS G2 RSA CA OCSP 16
- Issuer: countryName=US, organizationName=Microsoft Corporation, commonName=Microsoft TLS RSA Root G2
- Serial: 33000000092799CF18B020C53F000000000009
- SHA-256: 1D959F28A67BE6DCF5ED1E393AB92CEBE24DE22B4BF12BBC2C4F01C044AF9955
- SPKI SHA-256: 93C86719AF780A1EBC01F2952EA9E9C55C94420F8ACC2952E9FA0A45A73D1C8F
- Validity: 2025-06-26 to 2029-06-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:09:27:99:cf:18:b0:20:c5:3f:00:00:00:00:00:09
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = Microsoft Corporation, CN = Microsoft TLS RSA Root G2
        Validity
            Not Before: Jun 26 21:23:38 2025 GMT
            Not After : Jun  3 21:23:38 2029 GMT
        Subject: C = US, O = Microsoft Corporation, CN = Microsoft TLS G2 RSA CA OCSP 16
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                06:39:F0:56:D1:ED:90:C8:36:A3:A0:0F:94:FE:62:94:A7:E6:FC:37
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DE:91:86:48:B7:A1:31:59:31:F1:4B:5F:07:A9:DC:88:79:DA:A8:76
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
                  URI:http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                CA Issuers - URI:http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
                OCSP - URI:http://oneocsp.microsoft.com/ocsp
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1D959F28A67BE6DCF5ED1E393AB92CEBE24DE22B4BF12BBC2C4F01C044AF9955
    SPKI SHA256: 93C86719AF780A1EBC01F2952EA9E9C55C94420F8ACC2952E9FA0A45A73D1C8F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://oneocsp.microsoft.com/ocsp
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt, http://caissuers.microsoft.com/pkiops/certs/Microsoft%20TLS%20RSA%20Root%20G2%20-%20xsign.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl, http://crl2.microsoft.com/pkiops/crl/Microsoft%20TLS%20RSA%20Root%20G2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Microsoft TLS Issuing CA 01

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft TLS Issuing CA 01
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000000309A4FEB7D2C2ABCA000000000003
- SHA-256: F6BE0E24C9BB74DB7674261E7404D7A39D0C1862708B8A0A49D184D8B0C9B914
- SPKI SHA-256: 94D5253277CA4580E71554AAB7167D8D81C242C1FDFE3E7A8B28DCD5F8F2D9A3
- Validity: 2018-05-31 to 2023-05-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:03:09:a4:fe:b7:d2:c2:ab:ca:00:00:00:00:00:03
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:28:24 2018 GMT
            Not After : May 31 20:28:24 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft TLS Issuing CA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                88:0A:A3:27:E9:7E:A3:65:AC:40:17:9E:9B:73:C1:99:62:CC:BD:BD
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F6BE0E24C9BB74DB7674261E7404D7A39D0C1862708B8A0A49D184D8B0C9B914
    SPKI SHA256: 94D5253277CA4580E71554AAB7167D8D81C242C1FDFE3E7A8B28DCD5F8F2D9A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000140E723766CFB1420F000000000014
- SHA-256: 43BD5BB8C7926D34494B29D50E2D6E457116478A3E5566240856B9DF90513F8B
- SPKI SHA-256: 079A9336D0803DB7DB00B243F10094CC5B3077657A3AEBE90CD08E317E219B19
- Validity: 2019-07-25 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:14:0e:72:37:66:cf:b1:42:0f:00:00:00:00:00:14
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:30:39 2019 GMT
            Not After : May 14 17:30:39 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ...^9?..RQ.
jmnG.f \|{
            X509v3 Subject Key Identifier:
                56:82:4A:F8:3C:C7:54:16:93:4D:B0:DB:50:B4:95:51:F1:FF:7B:A2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 43BD5BB8C7926D34494B29D50E2D6E457116478A3E5566240856B9DF90513F8B
    SPKI SHA256: 079A9336D0803DB7DB00B243F10094CC5B3077657A3AEBE90CD08E317E219B19
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 02

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 02
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000000C1DFF833EC83C2B7400000000000C
- SHA-256: E9777CA0DCA1C61605DAEC7D0756AA9182AC56C67B921166BD234B1BC4B874D2
- SPKI SHA-256: 079A9336D0803DB7DB00B243F10094CC5B3077657A3AEBE90CD08E317E219B19
- Validity: 2019-05-14 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0c:1d:ff:83:3e:c8:3c:2b:74:00:00:00:00:00:0c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:02:06 2019 GMT
            Not After : May 14 21:02:06 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS Issuing CA 02
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                56:82:4A:F8:3C:C7:54:16:93:4D:B0:DB:50:B4:95:51:F1:FF:7B:A2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E9777CA0DCA1C61605DAEC7D0756AA9182AC56C67B921166BD234B1BC4B874D2
    SPKI SHA256: 079A9336D0803DB7DB00B243F10094CC5B3077657A3AEBE90CD08E317E219B19
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 03

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 03
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000000D5AFDB3E4503C70E200000000000D
- SHA-256: D293B604D83FDC92433EC5F9B06E5702A60A9D6282CEAF2584D8B83757530464
- SPKI SHA-256: 4235345DA557DAC9621521F6E5597F1E15E9064C132414E4949FA7978FFA203F
- Validity: 2019-05-14 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0d:5a:fd:b3:e4:50:3c:70:e2:00:00:00:00:00:0d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:02:07 2019 GMT
            Not After : May 14 21:02:07 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS Issuing CA 03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                FF:8E:C7:21:20:6A:25:A8:A4:B4:94:5A:23:E9:C9:5D:47:A5:82:A6
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D293B604D83FDC92433EC5F9B06E5702A60A9D6282CEAF2584D8B83757530464
    SPKI SHA256: 4235345DA557DAC9621521F6E5597F1E15E9064C132414E4949FA7978FFA203F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 03

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=AOC, commonName=Microsoft TLS Issuing CA 03
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000015085DCE13507604C8000000000015
- SHA-256: 2625F98AA5A186DAA55AC7B6CFA7A9C28D99F6EDE830F1317E7FED350EA18B9D
- SPKI SHA-256: 4235345DA557DAC9621521F6E5597F1E15E9064C132414E4949FA7978FFA203F
- Validity: 2019-07-25 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:15:08:5d:ce:13:50:76:04:c8:00:00:00:00:00:15
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:30:40 2019 GMT
            Not After : May 14 17:30:40 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = AOC, CN = Microsoft TLS Issuing CA 03
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ...{.Z..G..A..../Z....
            X509v3 Subject Key Identifier:
                FF:8E:C7:21:20:6A:25:A8:A4:B4:94:5A:23:E9:C9:5D:47:A5:82:A6
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2625F98AA5A186DAA55AC7B6CFA7A9C28D99F6EDE830F1317E7FED350EA18B9D
    SPKI SHA256: 4235345DA557DAC9621521F6E5597F1E15E9064C132414E4949FA7978FFA203F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 05

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 05
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000043F51ECC602131C4C000000000004
- SHA-256: 4BC9FE53CE532690216E157C76C77155793C9BE895D9F6718EA3D3D1FD694ABA
- SPKI SHA-256: 798D4BE7636539A559BAA70BECC6CE7678FA386D2899163DC6A7F30D959FE5EA
- Validity: 2018-05-31 to 2023-05-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:04:3f:51:ec:c6:02:13:1c:4c:00:00:00:00:00:04
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 31 20:28:25 2018 GMT
            Not After : May 31 20:28:25 2023 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS Issuing CA 05
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                EE:20:AC:FE:B9:9F:F6:61:ED:FB:3F:A0:81:48:E4:F8:E2:86:9F:18
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4BC9FE53CE532690216E157C76C77155793C9BE895D9F6718EA3D3D1FD694ABA
    SPKI SHA256: 798D4BE7636539A559BAA70BECC6CE7678FA386D2899163DC6A7F30D959FE5EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000000E1EDF9B609EFAFF0100000000000E
- SHA-256: E2AC3130E3185DE24FB9B5776CAAFE3DBAA6875B986AECCEF5536BE6EB80DA2E
- SPKI SHA-256: A28F389AE7AAF72FDC1A1D131B9AD34136EE93CDB30FA932A3ABFE9A93A7EFCE
- Validity: 2019-05-14 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0e:1e:df:9b:60:9e:fa:ff:01:00:00:00:00:00:0e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:02:08 2019 GMT
            Not After : May 14 21:02:08 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                9B:33:E8:42:90:83:C8:73:73:85:BE:E1:96:36:18:36:D4:C7:1B:99
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E2AC3130E3185DE24FB9B5776CAAFE3DBAA6875B986AECCEF5536BE6EB80DA2E
    SPKI SHA256: A28F389AE7AAF72FDC1A1D131B9AD34136EE93CDB30FA932A3ABFE9A93A7EFCE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 06

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 06
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 3300000016C097F3161C6C9AE5000000000016
- SHA-256: E42E2A45F090034EEBB057A76E5AF10D5B49D3F6F9AC40D2F73B6DB6FF0C3497
- SPKI SHA-256: A28F389AE7AAF72FDC1A1D131B9AD34136EE93CDB30FA932A3ABFE9A93A7EFCE
- Validity: 2019-07-25 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:16:c0:97:f3:16:1c:6c:9a:e5:00:00:00:00:00:16
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:30:41 2019 GMT
            Not After : May 14 17:30:41 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS Issuing CA 06
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ...8.P..Dh...j..H...o.
            X509v3 Subject Key Identifier:
                9B:33:E8:42:90:83:C8:73:73:85:BE:E1:96:36:18:36:D4:C7:1B:99
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E42E2A45F090034EEBB057A76E5AF10D5B49D3F6F9AC40D2F73B6DB6FF0C3497
    SPKI SHA256: A28F389AE7AAF72FDC1A1D131B9AD34136EE93CDB30FA932A3ABFE9A93A7EFCE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 07

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 07
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 330000000FD5F279C64DE3514600000000000F
- SHA-256: 18FD1823583B071E05043CDE589E01E3EC890B3A996B1DB6B11243042D271DE5
- SPKI SHA-256: 887365EC5E5B97D6A9A601A78D0DD5CD7605D60A380E6A9B5D9CDA70CABEF256
- Validity: 2019-05-14 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:0f:d5:f2:79:c6:4d:e3:51:46:00:00:00:00:00:0f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: May 14 21:02:10 2019 GMT
            Not After : May 14 21:02:10 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS Issuing CA 07
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                54:21:81:18:91:F7:DF:AC:12:71:35:8E:7A:B9:90:6F:A3:17:E0:C2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 18FD1823583B071E05043CDE589E01E3EC890B3A996B1DB6B11243042D271DE5
    SPKI SHA256: 887365EC5E5B97D6A9A601A78D0DD5CD7605D60A380E6A9B5D9CDA70CABEF256
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Microsoft TLS Issuing CA 07

- Subject: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, organizationalUnitName=EOC, commonName=Microsoft TLS Issuing CA 07
- Issuer: countryName=US, stateOrProvinceName=Washington, localityName=Redmond, organizationName=Microsoft Corporation, commonName=Microsoft RSA Root Certificate Authority 2017
- Serial: 33000000178F9C5D4DEC164F63000000000017
- SHA-256: BF6045C106C411AF1E0BA0081056C668E0C0F80380A52DE931267C955B7AE67C
- SPKI SHA-256: 887365EC5E5B97D6A9A601A78D0DD5CD7605D60A380E6A9B5D9CDA70CABEF256
- Validity: 2019-07-25 to 2024-05-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.msocsp.com
- CRL DP: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:00:17:8f:9c:5d:4d:ec:16:4f:63:00:00:00:00:00:17
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft RSA Root Certificate Authority 2017
        Validity
            Not Before: Jul 25 17:30:42 2019 GMT
            Not After : May 14 17:30:42 2024 GMT
        Subject: C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = EOC, CN = Microsoft TLS Issuing CA 07
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            1.3.6.1.4.1.311.21.1:
                ...
            1.3.6.1.4.1.311.21.2:
                ...=.@.3A.t......
....
            X509v3 Subject Key Identifier:
                54:21:81:18:91:F7:DF:AC:12:71:35:8E:7A:B9:90:6F:A3:17:E0:C2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.microsoft.com/pkiops/Docs/Repository.htm
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                09:CB:59:7F:86:B2:70:8F:1A:C3:39:E3:C0:D9:E9:BF:BB:4D:B2:23
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
            Authority Information Access:
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
                OCSP - URI:http://ocsp.msocsp.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BF6045C106C411AF1E0BA0081056C668E0C0F80380A52DE931267C955B7AE67C
    SPKI SHA256: 887365EC5E5B97D6A9A601A78D0DD5CD7605D60A380E6A9B5D9CDA70CABEF256
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.msocsp.com
- AIA CA Issuers: http://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
- CRL Distribution Points: http://www.microsoft.com/pkiops/crl/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired
