# CA Owner Audit Dump - SECOM Trust Systems Co., Ltd.

Generated: 2026-08-06T13:31:48.555205Z

## CA Owner Summary

- Name: SECOM Trust Systems Co., Ltd.
- Country: Japan
- Website: -
- Problem Reporting: https://www.secomtrust.net/sts/cert/report_entry.html
- CP/CPS URLs: https://repository.secomtrust.net/rootrepository/CPSen.pdf, https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md, https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md, https://repository.secomtrust.net/EV-Root1/index.html, https://www.cybertrust.ne.jp/ssl/repository/, https://www.cybertrust.ne.jp/ssl/repository/SMCPCPS_English.md, https://www.cybertrust.ne.jp/ssl/repository/TLSCPCPS_English.md, https://repo1.secomtrust.net/sppca/xerox/fxprdcapb/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf, https://repo1.secomtrust.net/sppca/xerox/xnetcac/CP.pdf, https://repo1.secomtrust.net/sppca/xerox/xnetcas2/CP.pdf, https://repo1.secomtrust.net/sppca/ff/fnetcac/, https://repo1.secomtrust.net/sppca/ff/fnetcac/Fnet_CA-C_CP-CPS_EN.md, http://repo1.secomtrust.net/sppca/xerox/fnetcas2/CP.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CP-en.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CPS-en.pdf, https://jprs.jp/pubcert/info/repository/, https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md, https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/, https://repo1.secomtrust.net/sppca/nii/odca3/NIIODCA3.pdf, https://repo1.secomtrust.net/sppca/nii/odca4/, https://repo1.secomtrust.net/sppca/nii/odca3/index.html, https://repo1.secomtrust.net/spcpp/cps/index.html, https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwevca/, https://repo1.secomtrust.net/spcpp/pfw/pfwmhca/PfWMHCA-CP2.pdf, https://repo1.secomtrust.net/spcpp/pfw/pfwsr2ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/PfWSRCA-CP.pdf, https://repo1.secomtrust.net/spcpp/plus/plus-cp-EN.pdf, https://repo1.secomtrust.net/spcpp/ts/TSCA-CP-EN.pdf, https://repository.secomtrust.net/SC-Root/, https://repo1.secomtrust.net/sppca/SMBC2/, https://repo1.secomtrust.net/sppca/SMBC2/CPCPS_EN.pdf, https://repo1.secomtrust.net/sppca/SMBC2/CPCPS.pdf
- Audit URLs: https://cert.webtrust.org/SealFile?seal=1534&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19e3c31f-788f-411c-8058-e44767284c5a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b64646d-a9d6-4a8e-8ffe-ce58fbe620ae, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b4e7bba-7e88-4863-923c-822e9105d662, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d3861e3c-1857-48f8-881b-4d070accedff, https://bugzilla.mozilla.org/attachment.cgi?id=8805235, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c80d60d6-fb4a-4063-b9a7-9ee1620ce273, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9ee7034-a7a3-4a75-b9e7-e36e7b518260, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a133005a-4734-4dbb-aa55-0ee3310f92c3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbfad336-88f5-442d-8ce1-283f0b63385b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f49669db-4845-41ed-bfe7-ed102bf7bca0, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c746d4bb-76f6-43a4-befa-fbd4c7f1ecdc, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=67933f3d-217b-41d4-aded-ed68b6305328, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c03c81fa-b455-4eb6-b45f-8d463d203f71, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2bbb627a-8f23-4fe0-8676-61c4a1b882b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4fb74a06-3d95-4780-b361-fc6ebcc9f85a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6494439-6e3d-4419-8084-9f2fe1cfc2b2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b1800b13-762b-4477-94d2-da5523f81477, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ee0fc63f-baa8-47c5-8353-8065ac4afaa5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc14557-e88f-47d7-85ed-33a35a3ce655, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9422ccb2-25df-4259-b7f3-2de92f3c26dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=673ba97e-1533-4d56-9acb-a10a48cae575, https://cert.webtrust.org/SealFile?seal=2105&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221097, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221096
- Root Programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://www.secomtrust.net/sts/cert/report_entry.html
- CP/CPS URLs: https://repository.secomtrust.net/rootrepository/CPSen.pdf, https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md, https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md, https://repository.secomtrust.net/EV-Root1/index.html, https://www.cybertrust.ne.jp/ssl/repository/, https://www.cybertrust.ne.jp/ssl/repository/SMCPCPS_English.md, https://www.cybertrust.ne.jp/ssl/repository/TLSCPCPS_English.md, https://repo1.secomtrust.net/sppca/xerox/fxprdcapb/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf, https://repo1.secomtrust.net/sppca/xerox/xnetcac/CP.pdf, https://repo1.secomtrust.net/sppca/xerox/xnetcas2/CP.pdf, https://repo1.secomtrust.net/sppca/ff/fnetcac/, https://repo1.secomtrust.net/sppca/ff/fnetcac/Fnet_CA-C_CP-CPS_EN.md, http://repo1.secomtrust.net/sppca/xerox/fnetcas2/CP.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CP-en.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CPS-en.pdf, https://jprs.jp/pubcert/info/repository/, https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md, https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/, https://repo1.secomtrust.net/sppca/nii/odca3/NIIODCA3.pdf, https://repo1.secomtrust.net/sppca/nii/odca4/, https://repo1.secomtrust.net/sppca/nii/odca3/index.html, https://repo1.secomtrust.net/spcpp/cps/index.html, https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwevca/, https://repo1.secomtrust.net/spcpp/pfw/pfwmhca/PfWMHCA-CP2.pdf, https://repo1.secomtrust.net/spcpp/pfw/pfwsr2ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/PfWSRCA-CP.pdf, https://repo1.secomtrust.net/spcpp/plus/plus-cp-EN.pdf, https://repo1.secomtrust.net/spcpp/ts/TSCA-CP-EN.pdf, https://repository.secomtrust.net/SC-Root/, https://repo1.secomtrust.net/sppca/SMBC2/, https://repo1.secomtrust.net/sppca/SMBC2/CPCPS_EN.pdf, https://repo1.secomtrust.net/sppca/SMBC2/CPCPS.pdf
- Audit URLs: https://cert.webtrust.org/SealFile?seal=1534&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19e3c31f-788f-411c-8058-e44767284c5a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b64646d-a9d6-4a8e-8ffe-ce58fbe620ae, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b4e7bba-7e88-4863-923c-822e9105d662, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d3861e3c-1857-48f8-881b-4d070accedff, https://bugzilla.mozilla.org/attachment.cgi?id=8805235, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c80d60d6-fb4a-4063-b9a7-9ee1620ce273, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9ee7034-a7a3-4a75-b9e7-e36e7b518260, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a133005a-4734-4dbb-aa55-0ee3310f92c3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbfad336-88f5-442d-8ce1-283f0b63385b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f49669db-4845-41ed-bfe7-ed102bf7bca0, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c746d4bb-76f6-43a4-befa-fbd4c7f1ecdc, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=67933f3d-217b-41d4-aded-ed68b6305328, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c03c81fa-b455-4eb6-b45f-8d463d203f71, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2bbb627a-8f23-4fe0-8676-61c4a1b882b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4fb74a06-3d95-4780-b361-fc6ebcc9f85a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6494439-6e3d-4419-8084-9f2fe1cfc2b2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b1800b13-762b-4477-94d2-da5523f81477, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ee0fc63f-baa8-47c5-8353-8065ac4afaa5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc14557-e88f-47d7-85ed-33a35a3ce655, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9422ccb2-25df-4259-b7f3-2de92f3c26dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=673ba97e-1533-4d56-9acb-a10a48cae575, https://cert.webtrust.org/SealFile?seal=2105&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221097, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221096
- Repository URLs: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/, https://repo1.secomtrust.net/sppca/xtdv5/, https://repo1.secomtrust.net/sppca/xtov5/, https://www.cybertrust.ne.jp/ssl/repository/, https://repo1.secomtrust.net/sppca/xerox/fxprdcapb/, https://repo1.secomtrust.net/sppca/xerox/xnetcac/, https://repo1.secomtrust.net/sppca/xerox/xnetcas2/, http://repo1.secomtrust.net/sppca/xerox/fnetcas2/, https://jprs.jp/pubcert/info/repository/, https://repo1.secomtrust.net/sppca/lgpki/, https://repo1.secomtrust.net/sppca/nii/odca3/, https://repo1.secomtrust.net/sppca/nii/odca4/, https://repo1.secomtrust.net/sppca/nii/odca3/index.html, https://repo1.secomtrust.net/spcpp/ts/, https://repo1.secomtrust.net/spcpp/pfm20pub/, https://repo1.secomtrust.net/spcpp/pfm20pub/index.html, https://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/, https://repo1.secomtrust.net/spcpp/tlssub/, https://repo1.secomtrust.net/spcpp/pfw/pfwmhca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/, https://repo1.secomtrust.net/spcpp/plus/, https://repo1.secomtrust.net/spcpp/ts/index.html, https://repo1.secomtrust.net/subadvcag2/
- Root programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | localityName=ValiCert Validation Network, organizationName=ValiCert, Inc., organizationalUnitName=ValiCert Class 1 Policy Validation Authority, commonName=http://www.valicert.com/, emailAddress=info@valicert.com | yes | expired | 1999-06-25 to 2019-06-25 | - | - | - | historical errors: 4 |
| 2 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Document Signing RSA Root CA 2023, organizationIdentifier=NTRJP-4011001040781 | yes | unknown | 2023-01-25 to 2048-01-01 | - | - | - | clean |
| 3 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM RSA Root CA 2023 | yes | unknown | 2023-01-25 to 2048-01-01 | - | - | - | clean |
| 4 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM SMIME RSA Root CA 2024 | yes | unknown | 2024-01-31 to 2049-01-14 | - | - | - | clean |
| 5 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024 | yes | unknown | 2024-01-31 to 2049-01-14 | - | - | - | current errors: 1 |
| 6 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2023 | yes | unknown | 2023-01-25 to 2048-01-01 | - | - | - | clean |
| 7 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024 | yes | unknown | 2024-01-31 to 2049-01-14 | - | - | - | clean |
| 8 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1 | yes | unknown | 2016-06-16 to 2038-01-18 | - | - | - | clean |
| 9 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1 | yes | unknown | 2007-06-06 to 2037-06-06 | - | - | - | current errors: 1 |
| 10 | countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1 | yes | expired | 2003-09-30 to 2023-09-30 | - | - | - | historical errors: 3 |
| 11 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2 | yes | unknown | 2009-05-29 to 2029-05-29 | - | - | - | current errors: 1 |
| 12 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3 | yes | unknown | 2016-06-16 to 2038-01-18 | - | - | - | clean |
| 13 | countryName=JP, organizationName=Japanese Government, organizationalUnitName=Ministry of Defense, commonName=Certification Authority | yes | revoked | 2017-03-24 to 2027-03-24 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 14 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA1 | yes | expired | 2011-02-24 to 2021-02-24 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 15 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA3 | yes | revoked, expired | 2014-12-25 to 2024-12-25 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 16 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA4 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 17 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=CrossTrust DV CA5 | yes | revoked | 2018-08-22 to 2028-08-22 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 18 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA5 | yes | revoked | 2018-07-31 to 2028-07-31 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 19 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA1 | yes | expired | 2010-10-21 to 2020-10-21 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 20 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA3 | yes | revoked, expired | 2014-12-25 to 2024-12-25 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 21 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA4 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 22 | countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA5 | yes | revoked | 2018-07-31 to 2028-07-31 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 23 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=CrossTrust OV CA5 | yes | revoked | 2018-08-22 to 2028-08-22 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 24 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureMail CA G4 | yes | current | 2023-07-31 to 2029-05-29 | 2.23.140.1.5.2.1, 1.2.392.200091.100.901.4 | 0 | E-mail Protection | clean |
| 25 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureMail CA G4 | yes | revoked | 2019-09-27 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 26 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureMail CA G5 | yes | current | 2024-12-17 to 2029-05-29 | 2.23.140.1.5.2.3, 1.2.392.200091.100.901.4 | 0 | E-mail Protection | clean |
| 27 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer CA G4 | yes | current | 2019-09-27 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 28 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer CA G4 | yes | current | 2023-12-13 to 2029-05-29 | 2.23.140.1.2.2, 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 29 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer EV CA G3 | yes | current | 2023-12-13 to 2029-05-29 | 2.23.140.1.1, 1.2.392.200091.100.721.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 30 | countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer EV CA G3 | yes | current | 2019-09-27 to 2029-05-29 | 1.2.392.200091.100.721.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 31 | countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V2 | yes | revoked, expired | 2013-12-24 to 2023-12-24 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 1 |
| 32 | countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V3 | yes | revoked, expired | 2014-12-16 to 2024-12-16 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 33 | countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V3 | yes | revoked | 2018-03-22 to 2028-03-22 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 34 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=EINS/PKI Public Certification Authority V4 | yes | revoked | 2018-08-22 to 2028-08-22 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 35 | countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V4 | yes | revoked | 2018-07-31 to 2028-07-31 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 36 | countryName=JP, organizationName=Fuji Xerox, commonName=Fnet CA | yes | expired | 2012-06-20 to 2021-03-31 | 1.3.6.1.4.1.297.1.5.1.12 | 0 | - | historical errors: 1 |
| 37 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority - G2 | yes | expired | 2011-03-31 to 2021-03-31 | 1.2.392.200091.100.901.4 | 1 | - | clean |
| 38 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority 2 | yes | expired | 2011-03-31 to 2021-03-31 | 1.2.392.200091.100.901.1 | 1 | - | clean |
| 39 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority-PB | yes | revoked | 2019-07-24 to 2029-05-29 | 1.2.392.200091.100.901.4 | 1 | TLS Web Client Authentication | clean |
| 40 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority-PB | yes | revoked | 2019-03-28 to 2029-05-29 | 1.2.392.200091.100.901.4 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 3 |
| 41 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Endorsement CA - G2 | yes | expired | 2011-04-17 to 2021-03-31 | 1.3.6.1.4.1.297.1.5.1.8 | 0 | - | historical errors: 1 |
| 42 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Endorsement CA 2 | yes | revoked, expired | 2011-04-17 to 2021-03-31 | 1.3.6.1.4.1.297.1.5.1.12 | 0 | - | historical errors: 1 |
| 43 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Product CA - S | yes | revoked, expired | 2015-09-18 to 2025-09-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 44 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Product CA 2 - S | yes | revoked | 2018-04-18 to 2028-04-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 45 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Product CA-PB | yes | unknown | 2019-07-24 to 2029-05-29 | 1.2.392.200091.110.216.4 | 0 | TLS Web Client Authentication | clean |
| 46 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - C | yes | revoked | 2021-06-29 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication | clean |
| 47 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - C | yes | revoked | 2016-09-08 to 2026-09-08 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 48 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - G2 | yes | expired | 2015-08-12 to 2021-03-31 | 1.3.6.1.4.1.297.1.5.1.8 | 0 | - | historical errors: 4 |
| 49 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - S | yes | revoked, expired | 2015-09-18 to 2025-09-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 50 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - S2 | yes | revoked | 2020-10-16 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 51 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - S2 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 52 | countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA 2 | yes | expired | 2012-06-20 to 2021-03-31 | 1.3.6.1.4.1.297.1.5.1.12 | 0 | - | historical errors: 1 |
| 53 | countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - C | yes | current | 2021-06-29 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication | clean |
| 54 | countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - C | yes | revoked | 2016-09-08 to 2026-09-08 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 55 | countryName=JP, organizationName=Fuji Xerox, commonName=FUJIFILM Fnet CA - G2 | yes | expired | 2015-08-12 to 2021-03-31 | 1.3.6.1.4.1.297.1.5.1.8 | 0 | - | historical errors: 4 |
| 56 | countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - S | yes | revoked, expired | 2015-09-18 to 2025-09-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 57 | countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - S2 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 58 | countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - S2 | yes | revoked | 2020-12-15 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 59 | countryName=JP, organizationName=Nijimo, Inc., commonName=FujiSSL Public Certification Authority - G1 | yes | revoked | 2016-08-16 to 2026-08-16 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 60 | countryName=JP, organizationName=Nijimo, Inc., commonName=FujiSSL Public Certification Authority - G2 | yes | revoked | 2018-04-18 to 2028-04-18 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 61 | countryName=JP, organizationName=Nijimo, Inc., commonName=FujiSSL Public Validation Authority - G3 | yes | revoked | 2018-07-31 to 2028-07-31 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 62 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=FujiSSL Public Validation Authority - G3 | yes | revoked | 2018-08-22 to 2028-08-22 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 63 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G1 | yes | revoked, expired | 2016-04-06 to 2026-04-06 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 64 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G2 | yes | revoked | 2018-03-09 to 2028-03-09 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 65 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G3 | yes | revoked | 2019-07-11 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, OCSP Signing | historical errors: 1 |
| 66 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G3 | yes | revoked | 2020-07-10 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 67 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G3 | yes | revoked | 2020-07-10 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 68 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G4 | yes | current | 2020-07-22 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 69 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS DV ECC CA 2024 G1 | yes | current | 2024-04-04 to 2031-06-16 | 2.23.140.1.2.1, 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 70 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS DV RSA CA 2024 G1 | yes | current | 2024-04-04 to 2039-01-12 | 2.23.140.1.2.1, 1.2.392.200091.100.901.11 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 71 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G1 | yes | revoked, expired | 2016-04-06 to 2026-04-06 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 72 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G2 | yes | revoked | 2018-03-09 to 2028-03-09 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 73 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G3 | yes | revoked | 2020-07-10 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 74 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G3 | yes | revoked | 2019-07-11 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, OCSP Signing | historical errors: 1 |
| 75 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G3 | yes | revoked | 2020-07-10 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 76 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G4 | yes | current | 2020-07-22 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 77 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS OV ECC CA 2024 G1 | yes | current | 2024-04-04 to 2031-06-16 | 2.23.140.1.2.2, 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 78 | countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS OV RSA CA 2024 G1 | yes | current | 2024-04-04 to 2039-01-12 | 2.23.140.1.2.2, 1.2.392.200091.100.901.11 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 79 | countryName=JP, organizationName=KAGOYA JAPAN Inc., commonName=KAGOYA JAPAN Certification Authority | yes | revoked, expired | 2012-12-20 to 2022-12-20 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 1 |
| 80 | countryName=JP, organizationName=KDDI Web Communications Inc., commonName=KDDI Web Communications Certification Authority | yes | revoked, expired | 2015-03-26 to 2025-03-26 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 81 | countryName=JP, organizationName=KDDI Web Communications Inc., commonName=KDDI Web Communications Certification Authority 2 | yes | revoked | 2018-04-10 to 2028-04-10 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 82 | countryName=JP, organizationName=KDDI Web Communications Inc., commonName=KDDI Web Communications Certification Authority 3 | yes | revoked | 2018-07-31 to 2028-07-31 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 83 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=KDDI Web Communications Certification Authority 3 | yes | revoked | 2018-08-22 to 2028-08-22 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 84 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=LGPKI AATL RSA CA 2024, organizationIdentifier=NTRJP-4011001040781 | yes | current | 2024-08-08 to 2044-07-07 | 1.2.392.200091.100.901.10 | 0 | 1.2.840.113583.1.1.5 | clean |
| 85 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G3 | yes | expired | 2014-12-25 to 2018-12-25 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 1 |
| 86 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G4 | yes | revoked, expired | 2014-12-25 to 2024-12-25 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 87 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G4 | yes | revoked | 2021-07-12 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication | clean |
| 88 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G5 | yes | revoked | 2020-05-20 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 2 |
| 89 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G5 | yes | revoked | 2020-03-23 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 2 |
| 90 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G5 | yes | revoked | 2018-03-22 to 2028-03-22 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 91 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6 | yes | revoked | 2020-05-20 to 2030-05-20 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 2 |
| 92 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6 | yes | revoked | 2018-03-22 to 2028-03-22 | 1.2.392.200091.100.902.1 | 0 | - | historical errors: 1 |
| 93 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6 | yes | revoked | 2019-03-14 to 2029-03-14 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 94 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6 | yes | revoked | 2020-03-23 to 2030-03-23 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 2 |
| 95 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=NII Open Domain CA - G7 ECC | yes | current | 2020-12-15 to 2030-12-15 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 96 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=NII Open Domain CA - G7 RSA | yes | current | 2020-12-15 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 97 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=NII Open Domain CA - G8 ECC | yes | current | 2026-08-05 to 2029-06-05 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | not_available |
| 98 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=NII Open Domain CA - G8 RSA | yes | current | 2025-08-21 to 2040-08-21 | 2.23.140.1.2.2, 1.2.392.200091.100.901.11 | 0 | TLS Web Server Authentication | clean |
| 99 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain ClientAuth CA | yes | revoked | 2020-03-05 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication | clean |
| 100 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain Code Signing CA | yes | revoked, expired | 2015-02-26 to 2023-02-22 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 1 |
| 101 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain Code Signing CA - G2 | yes | revoked, expired | 2015-02-26 to 2025-02-26 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 102 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain S/MIME CA | yes | revoked | 2016-12-21 to 2026-12-21 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 103 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain S/MIME CA | yes | revoked | 2021-07-12 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | E-mail Protection, TLS Web Client Authentication | clean |
| 104 | countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain S/MIME CA - G2 | yes | revoked | 2020-03-05 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 105 | countryName=JP, stateOrProvinceName=Osaka, localityName=Ibaraki, organizationName=Osaka University, commonName=Osaka University Public RootCA | yes | revoked, expired | 2010-07-30 to 2020-07-30 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 106 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM AATL Time Stamping RSA CA 2024, organizationIdentifier=NTRJP-4011001040781 | yes | current | 2024-08-08 to 2044-07-14 | 1.2.392.200091.100.901.10 | 0 | Time Stamping | clean |
| 107 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Code Signing CA | yes | revoked, expired | 2014-07-23 to 2024-07-23 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 1 |
| 108 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for CodeSigning CA G2 | yes | revoked | 2021-05-25 to 2031-05-25 | 1.2.392.200091.100.901.6, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 109 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for CodeSigning CA G2 | yes | revoked | 2020-08-06 to 2029-05-29 | 1.2.392.200091.100.901.4, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 110 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA1 | yes | revoked, expired | 2021-07-12 to 2023-09-30 | 1.2.392.200091.100.901.1 | 0 | TLS Web Client Authentication, Microsoft Smartcard Login | clean |
| 111 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA1 | yes | revoked, expired | 2013-04-02 to 2023-04-02 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 112 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA1 | yes | expired | 2008-05-02 to 2018-05-02 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 113 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA10 | yes | revoked | 2018-08-10 to 2028-08-10 | 1.2.392.200091.100.901.4 | 0 | E-mail Protection | clean |
| 114 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA2 | yes | revoked, expired | 2013-08-20 to 2023-08-20 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 115 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA2 | yes | revoked, expired | 2021-07-12 to 2023-09-30 | 1.2.392.200091.100.901.1 | 0 | TLS Web Client Authentication | clean |
| 116 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA2 | yes | expired | 2008-09-11 to 2018-09-11 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 117 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA3 | yes | expired | 2009-03-19 to 2019-03-19 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 118 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA3 | yes | revoked, expired | 2021-07-12 to 2023-09-30 | 1.2.392.200091.100.901.1 | 0 | TLS Web Client Authentication, Microsoft Smartcard Login | clean |
| 119 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA3 | yes | revoked, expired | 2013-08-20 to 2023-08-20 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 120 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA4 | yes | current | 2018-10-04 to 2028-10-04 | 1.2.392.200091.100.901.4 | 0 | - | current errors: 1 |
| 121 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA4 | yes | expired | 2013-11-20 to 2023-11-20 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 2 |
| 122 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA5 | yes | current | 2020-05-20 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | E-mail Protection, TLS Web Client Authentication | clean |
| 123 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA5 | yes | expired | 2015-08-12 to 2025-08-12 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 124 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA6 | yes | revoked, expired | 2015-12-22 to 2025-12-22 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 125 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA7 | yes | current | 2021-07-12 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 126 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA7 | yes | revoked | 2017-03-24 to 2027-03-24 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 127 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA8 | yes | current | 2018-01-09 to 2028-01-09 | 1.2.392.200091.100.901.4 | 0 | - | current errors: 1 |
| 128 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CodeSigning CA G1 | yes | revoked | 2020-07-08 to 2029-05-29 | 1.2.392.200091.100.901.4, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 129 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CodeSigning CA G1 | yes | revoked | 2020-02-21 to 2029-05-29 | 1.2.392.200091.100.901.4, 2.23.140.1.4.1 | 0 | Code Signing, OCSP Signing | historical errors: 1 |
| 130 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID AATL RSA CA 2023, organizationIdentifier=NTRJP-4011001040781 | yes | current | 2023-02-24 to 2043-02-01 | 1.2.392.200091.100.901.10 | 0 | 1.2.840.113583.1.1.5 | clean |
| 131 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID Document Signing RSA CA 2023 | yes | current | 2023-02-24 to 2043-02-01 | 1.2.392.200091.100.901.9 | 0 | 1.3.6.1.4.1.311.10.3.12 | clean |
| 132 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID SMIME RSA CA 2023 | yes | current | 2023-06-07 to 2029-05-29 | 1.2.392.200091.100.901.4, 2.23.140.1.5.1.3 | 0 | E-mail Protection | clean |
| 133 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID SMIME RSA CA 2024 | yes | current | 2024-05-16 to 2042-01-15 | 2.23.140.1.5.1.3, 1.2.392.200091.100.901.12 | 0 | E-mail Protection | current errors: 1 |
| 134 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV 2.0 CA | yes | revoked, expired | 2014-09-03 to 2024-09-03 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 135 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV 2.0 CA | yes | current | 2023-08-30 to 2029-05-29 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 136 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV 2.0 CA | yes | expired | 2014-12-16 to 2024-12-16 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 137 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV CA | yes | expired | 2007-06-14 to 2017-06-14 | 2.5.29.32.0 | 0 | - | clean |
| 138 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV CA | yes | expired | 2012-11-13 to 2022-11-13 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 139 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web EV ECC CA 2024 | yes | current | 2024-05-16 to 2039-01-12 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 140 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web EV RSA CA 2024 | yes | current | 2024-05-16 to 2039-01-12 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 141 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web MH CA | yes | revoked | 2018-07-31 to 2028-07-31 | 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 142 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web MH CA | yes | revoked, expired | 2015-12-30 to 2025-12-30 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 143 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web OV ECC CA 2024 | yes | current | 2024-05-16 to 2039-01-12 | 2.23.140.1.2.2, 1.2.392.200091.100.902.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 144 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web OV RSA CA 2024 | yes | current | 2024-05-16 to 2039-01-12 | 2.23.140.1.2.2, 1.2.392.200091.100.901.11 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 145 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 2.0 CA | yes | revoked, expired | 2012-02-17 to 2022-02-17 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 146 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 2.0 CA | yes | expired | 2008-02-28 to 2018-02-28 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 147 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 2.0 CA | yes | revoked, expired | 2012-11-13 to 2022-11-13 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 1 |
| 148 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA | yes | revoked, expired | 2013-12-06 to 2023-12-06 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 2 |
| 149 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA | yes | current | 2025-04-09 to 2028-03-16 | 2.23.140.1.2.2, 1.2.392.200091.100.901.4 | 0 | TLS Web Server Authentication | clean |
| 150 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA | yes | revoked, expired | 2014-09-03 to 2024-09-03 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 151 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA | yes | current | 2018-03-16 to 2028-03-16 | 1.2.392.200091.100.901.4 | 0 | - | current errors: 1 |
| 152 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport Plus CA1 G1 | yes | current | 2022-04-15 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | 1.3.6.1.4.1.311.10.3.12 | clean |
| 153 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM SMIME RSA Root CA 2024 | yes | current | 2025-04-09 to 2029-05-29 | 2.5.29.32.0 | - | E-mail Protection | clean |
| 154 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA1 | yes | revoked, expired | 2011-06-28 to 2022-07-29 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 155 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA1 | yes | revoked, expired | 2021-07-12 to 2023-09-30 | 1.2.392.200091.100.901.1 | 0 | Time Stamping | clean |
| 156 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA2 | yes | revoked, expired | 2016-03-29 to 2026-03-29 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 157 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA2 | yes | current | 2021-07-12 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | Time Stamping | clean |
| 158 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA3 | yes | current | 2018-06-07 to 2037-12-31 | 1.2.392.200091.100.901.7 | 0 | - | current errors: 1 |
| 159 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA4 | yes | revoked | 2020-12-15 to 2037-12-31 | 1.2.392.200091.100.901.7 | 0 | Time Stamping | clean |
| 160 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA4 | yes | revoked | 2023-02-24 to 2043-02-01 | 1.2.392.200091.100.901.9 | 0 | Time Stamping | clean |
| 161 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024 | yes | current | 2025-04-09 to 2038-01-18 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 162 | countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024 | yes | current | 2025-04-09 to 2029-05-29 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 163 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1 | yes | current | 2024-04-04 to 2029-05-29 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 164 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1 | yes | expired | 2007-06-14 to 2017-06-14 | 2.5.29.32.0 | - | - | clean |
| 165 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1 | yes | revoked, expired | 2012-11-13 to 2022-11-13 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 166 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2 | yes | revoked, expired | 2015-03-24 to 2023-09-29 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 167 | countryName=JP, organizationName=Servision Inc., commonName=Servision Certification Authority | yes | revoked, expired | 2012-11-08 to 2022-11-08 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 168 | countryName=JP, organizationName=Sumitomo Mitsui Banking Corporation, organizationalUnitName=SMBC Authority, commonName=SMBC Certificate Authority CA2 | yes | revoked, expired | 2015-11-25 to 2025-11-25 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 169 | countryName=JP, organizationName=Sumitomo Mitsui Banking Corporation, organizationalUnitName=SMBC Authority, commonName=SMBC Certificate Authority CA2 | yes | revoked | 2021-08-13 to 2029-05-29 | 1.2.392.200091.100.901.4 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 170 | countryName=JP, organizationName=Sumitomo Mitsui Banking Corporation, organizationalUnitName=SMBC Authority, commonName=SMBC Certificate Authority CA2 G2 | yes | revoked | 2020-11-06 to 2030-12-31 | 1.2.392.200091.100.901.6 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 171 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced CA G2 | yes | revoked | 2024-09-25 to 2038-01-18 | 1.2.392.200091.100.901.6 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 172 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced CA G2 | yes | revoked | 2020-10-07 to 2030-10-07 | 1.2.392.200091.100.901.6 | 0 | TLS Web Server Authentication | clean |
| 173 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced CA1 | yes | expired | 2016-12-15 to 2019-12-15 | 1.2.392.200091.100.901.6 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 174 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced ECC CA G2 | yes | revoked | 2024-09-25 to 2038-01-18 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication | historical errors: 2 |
| 175 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced ECC CA G2 | yes | revoked | 2020-10-07 to 2030-10-07 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication | clean |
| 176 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced ECC CA1 | yes | expired | 2016-12-15 to 2019-12-15 | 1.2.392.200091.100.902.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 177 | countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=SubordinateCA1 | yes | expired | 2009-02-17 to 2019-02-17 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 178 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SubordinateCA6 | yes | expired | 2009-10-28 to 2019-10-28 | 2.5.29.32.0 | 0 | - | clean |
| 179 | countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SubordinateCA6 | yes | expired | 2009-06-11 to 2019-06-11 | 1.2.392.200091.100.901.4 | 0 | - | clean |
| 180 | countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, organizationalUnitName=UPKI, organizationalUnitName=NII Open Domain CA | yes | revoked, expired | 2007-02-13 to 2017-02-13 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 181 | countryName=JP, localityName=Academe2, organizationName=National Institute of Informatics, organizationalUnitName=UPKI, organizationalUnitName=NII Open Domain CA - G2 | yes | revoked, expired | 2009-03-27 to 2019-03-27 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 182 | countryName=JP, organizationName=XiPS, commonName=XiPS CA | yes | revoked, expired | 2012-12-14 to 2022-12-14 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 183 | countryName=JP, organizationName=XiPS, commonName=XiPS CA2 | yes | revoked, expired | 2015-02-26 to 2025-02-26 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 184 | countryName=JP, organizationName=Yamaguchi Financial Group Inc., commonName=Yamaguchi Financial Group CA | yes | expired | 2009-03-27 to 2019-03-27 | 1.2.392.200091.100.901.1 | 0 | - | clean |
| 185 | countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for business | yes | revoked, expired | 2012-12-20 to 2022-12-20 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 186 | countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for business2 | yes | revoked, expired | 2015-05-27 to 2025-05-27 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |
| 187 | countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for domain | yes | revoked, expired | 2012-12-20 to 2022-12-20 | 1.2.392.200091.100.901.1 | 0 | - | historical errors: 2 |
| 188 | countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for domain2 | yes | revoked, expired | 2015-05-27 to 2025-05-27 | 1.2.392.200091.100.901.4 | 0 | - | historical errors: 1 |

## Certificate Details

### http://www.valicert.com/

- Subject: localityName=ValiCert Validation Network, organizationName=ValiCert, Inc., organizationalUnitName=ValiCert Class 1 Policy Validation Authority, commonName=http://www.valicert.com/, emailAddress=info@valicert.com
- Issuer: localityName=ValiCert Validation Network, organizationName=ValiCert, Inc., organizationalUnitName=ValiCert Class 1 Policy Validation Authority, commonName=http://www.valicert.com/, emailAddress=info@valicert.com
- Serial: 01
- SHA-256: F4C149551A3013A35BC7BFFE17A7F3449BC1AB5B5A0AE74B06C23B90004C0104
- SPKI SHA-256: 31DE0CB19F2ADBB0D1CD7B1B31EF8EE3EB59B74459AEF94B480BEEEEB85C64C9
- Validity: 1999-06-25 to 2019-06-25
- Key: RSA 1024
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.secomtrust.net/rootrepository/CPSen.pdf
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=1534&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: -
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: L = ValiCert Validation Network, O = "ValiCert, Inc.", OU = ValiCert Class 1 Policy Validation Authority, CN = http://www.valicert.com/, emailAddress = info@valicert.com
        Validity
            Not Before: Jun 25 22:23:48 1999 GMT
            Not After : Jun 25 22:23:48 2019 GMT
        Subject: L = ValiCert Validation Network, O = "ValiCert, Inc.", OU = ValiCert Class 1 Policy Validation Authority, CN = http://www.valicert.com/, emailAddress = info@valicert.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F4C149551A3013A35BC7BFFE17A7F3449BC1AB5B5A0AE74B06C23B90004C0104
    SPKI SHA256: 31DE0CB19F2ADBB0D1CD7B1B31EF8EE3EB59B74459AEF94B480BEEEEB85C64C9
```

#### Extensions

- Basic Constraints: {"present":false,"critical":false,"ca":false,"path_len":null}
- Key Usage: -
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_authority_key_identifier_no_key_identifier: 
- [historical] error e_rsa_mod_less_than_2048_bits: 
- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_subject_key_identifier_missing_sub_cert: 

#### Computed Flags

- is_root_ca
- is_self_signed
- is_ca
- is_expired

### SECOM Document Signing RSA Root CA 2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Document Signing RSA Root CA 2023, organizationIdentifier=NTRJP-4011001040781
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Document Signing RSA Root CA 2023, organizationIdentifier=NTRJP-4011001040781
- Serial: E3A2A1C4FE81A10D
- SHA-256: 46219BBF9148F00E8B7A4C619B57CF7602701FF81348400718870FABD31FC5BE
- SPKI SHA-256: 4D97C86857740C578E75C675ECE0ECF85784E07A72BDCB5F0EEBB2662B4004D9
- Validity: 2023-01-25 to 2048-01-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e3:a2:a1:c4:fe:81:a1:0d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Document Signing RSA Root CA 2023, organizationIdentifier = NTRJP-4011001040781
        Validity
            Not Before: Jan 25 08:33:59 2023 GMT
            Not After : Jan  1 08:33:59 2048 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Document Signing RSA Root CA 2023, organizationIdentifier = NTRJP-4011001040781
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                01:DD:B1:24:30:89:2C:C8:03:83:5E:10:AE:71:1E:49:F2:EE:4B:07
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 46219BBF9148F00E8B7A4C619B57CF7602701FF81348400718870FABD31FC5BE
    SPKI SHA256: 4D97C86857740C578E75C675ECE0ECF85784E07A72BDCB5F0EEBB2662B4004D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SECOM RSA Root CA 2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM RSA Root CA 2023
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM RSA Root CA 2023
- Serial: 99B8098D4418DDDB
- SHA-256: 2C154235528D701790B675AFF6E1970827B10ED665E913835BF46E3460FD5C84
- SPKI SHA-256: 1D21DC6F22972A0D6A90160EDE926A7762647307E77F627C258F80395BFAFD23
- Validity: 2023-01-25 to 2048-01-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=19e3c31f-788f-411c-8058-e44767284c5a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            99:b8:09:8d:44:18:dd:db
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM RSA Root CA 2023
        Validity
            Not Before: Jan 25 08:03:37 2023 GMT
            Not After : Jan  1 08:03:37 2048 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM RSA Root CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                51:33:6A:2A:EF:DB:1F:80:ED:B2:C6:D3:06:D2:25:93:C4:C8:B6:66
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2C154235528D701790B675AFF6E1970827B10ED665E913835BF46E3460FD5C84
    SPKI SHA256: 1D21DC6F22972A0D6A90160EDE926A7762647307E77F627C258F80395BFAFD23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SECOM SMIME RSA Root CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM SMIME RSA Root CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM SMIME RSA Root CA 2024
- Serial: DDA9DB9E7EBCD46D
- SHA-256: 3629E7188E00A7CB3232C4426BC84912F1218B1A9AE676C0B0ABE1DBFE2182B5
- SPKI SHA-256: 4E689536A4625544E0971C5EFCF5C1318EA1B5E3CA1EA4FBA3A82E2BA0DCB37F
- Validity: 2024-01-31 to 2049-01-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b64646d-a9d6-4a8e-8ffe-ce58fbe620ae
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/smimersa/smimersarootca2024.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            dd:a9:db:9e:7e:bc:d4:6d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM SMIME RSA Root CA 2024
        Validity
            Not Before: Jan 31 06:23:06 2024 GMT
            Not After : Jan 14 06:23:06 2049 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM SMIME RSA Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                7B:E1:9C:A8:36:1C:47:A4:04:FB:01:82:6F:BA:71:41:35:1C:30:B0
            X509v3 Authority Key Identifier:
                7B:E1:9C:A8:36:1C:47:A4:04:FB:01:82:6F:BA:71:41:35:1C:30:B0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3629E7188E00A7CB3232C4426BC84912F1218B1A9AE676C0B0ABE1DBFE2182B5
    SPKI SHA256: 4E689536A4625544E0971C5EFCF5C1318EA1B5E3CA1EA4FBA3A82E2BA0DCB37F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SECOM TLS ECC Root CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024
- Serial: 817A2CEF8F237A44
- SHA-256: 6AB2AB75F51CB4F4F0156203FBF6F646232F514BE059F62833308B82B4D72DB1
- SPKI SHA-256: 294679E0F97FFD474F19567B36382394E1B4960E030975E66353452034A3C5EA
- Validity: 2024-01-31 to 2049-01-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md; https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b4e7bba-7e88-4863-923c-822e9105d662, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d3861e3c-1857-48f8-881b-4d070accedff
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:7a:2c:ef:8f:23:7a:44
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS ECC Root CA 2024
        Validity
            Not Before: Jan 31 05:52:34 2024 GMT
            Not After : Jan 14 05:52:34 2049 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS ECC Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
            X509v3 Authority Key Identifier:
                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6AB2AB75F51CB4F4F0156203FBF6F646232F514BE059F62833308B82B4D72DB1
    SPKI SHA256: 294679E0F97FFD474F19567B36382394E1B4960E030975E66353452034A3C5EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SECOM TLS RSA Root CA 2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2023
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2023
- Serial: 9BE5E311E47B03A5
- SHA-256: 73D0CC0F9AA1F84E8F80C04324F182952FCC5CA2454D639D41F314F5461C21DA
- SPKI SHA-256: 0BE215CA95B0FC00A704C30EFB2879D3C5A751029F23BE53D52F1EC25A2AA3C9
- Validity: 2023-01-25 to 2048-01-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2023.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9b:e5:e3:11:e4:7b:03:a5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2023
        Validity
            Not Before: Jan 25 07:21:52 2023 GMT
            Not After : Jan  1 07:21:52 2048 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                53:62:0D:F9:C0:73:2C:4A:C6:DE:F4:19:A6:E3:B3:D9:38:71:23:1C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 73D0CC0F9AA1F84E8F80C04324F182952FCC5CA2454D639D41F314F5461C21DA
    SPKI SHA256: 0BE215CA95B0FC00A704C30EFB2879D3C5A751029F23BE53D52F1EC25A2AA3C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SECOM TLS RSA Root CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Serial: EE8934D0CB80E0B2
- SHA-256: 1435F225C5D252D7A21948CC3CE62AECFA88001E3DD72D1CC3555100EB372F93
- SPKI SHA-256: F0E0B6FBE8B74D4F82D8ED8F8BD6A3D083DC19DB3D2CEDB1061CCB76D848EE7D
- Validity: 2024-01-31 to 2049-01-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md; https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b4e7bba-7e88-4863-923c-822e9105d662, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d3861e3c-1857-48f8-881b-4d070accedff
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ee:89:34:d0:cb:80:e0:b2
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Validity
            Not Before: Jan 31 05:11:55 2024 GMT
            Not After : Jan 14 05:11:55 2049 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Authority Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1435F225C5D252D7A21948CC3CE62AECFA88001E3DD72D1CC3555100EB372F93
    SPKI SHA256: F0E0B6FBE8B74D4F82D8ED8F8BD6A3D083DC19DB3D2CEDB1061CCB76D848EE7D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Security Communication ECC RootCA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: D65D9BB378812EEB
- SHA-256: E74FBDA55BD564C473A36B441AA799C8A68E077440E8288B9FA1E50E4BBACA11
- SPKI SHA-256: 3329BFA13B6007AB5FC3713F0ACB289426E2FBC99CC5C110A914B139571600B6
- Validity: 2016-06-16 to 2038-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md; https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b4e7bba-7e88-4863-923c-822e9105d662, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d3861e3c-1857-48f8-881b-4d070accedff
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d6:5d:9b:b3:78:81:2e:eb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Jun 16 05:15:28 2016 GMT
            Not After : Jan 18 05:15:28 2038 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E74FBDA55BD564C473A36B441AA799C8A68E077440E8288B9FA1E50E4BBACA11
    SPKI SHA256: 3329BFA13B6007AB5FC3713F0ACB289426E2FBC99CC5C110A914B139571600B6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Security Communication EV RootCA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1
- Serial: 0
- SHA-256: A22DBA681E97376E2D397D728AAE3A9B6296B9FDBA60BC2E11F647F2C675FB37
- SPKI SHA-256: 6544FF9ADB642C4C3698A60D8143B6B93BCEF01365B540F614DCC2A45AB94D31
- Validity: 2007-06-06 to 2037-06-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.secomtrust.net/EV-Root1/index.html
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8805235
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Removed","chrome":"Not Included","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication EV RootCA1
        Validity
            Not Before: Jun  6 02:12:32 2007 GMT
            Not After : Jun  6 02:12:32 2037 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication EV RootCA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                35:4A:F5:4D:AF:3F:D7:82:38:AC:AB:71:65:17:75:8C:9D:55:93:E6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A22DBA681E97376E2D397D728AAE3A9B6296B9FDBA60BC2E11F647F2C675FB37
    SPKI SHA256: 6544FF9ADB642C4C3698A60D8143B6B93BCEF01365B540F614DCC2A45AB94D31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_serial_number_not_positive: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Security Communication RootCA1

- Subject: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 0
- SHA-256: E75E72ED9F560EEC6EB4800073A43FC3AD19195A392282017895974A99026B6C
- SPKI SHA-256: 2A4212605AA3E8AECB0FC19806CF3B40B53B95F1A34DBBD6E3ED27230324ABB3
- Validity: 2003-09-30 to 2023-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c80d60d6-fb4a-4063-b9a7-9ee1620ce273, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f9ee7034-a7a3-4a75-b9e7-e36e7b518260, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a133005a-4734-4dbb-aa55-0ee3310f92c3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bbfad336-88f5-442d-8ce1-283f0b63385b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f49669db-4845-41ed-bfe7-ed102bf7bca0
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Revocation status: -
- Browser status: {"apple":"Removed","chrome":"Removed","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Sep 30 04:20:49 2003 GMT
            Not After : Sep 30 04:20:49 2023 GMT
        Subject: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E75E72ED9F560EEC6EB4800073A43FC3AD19195A392282017895974A99026B6C
    SPKI SHA256: 2A4212605AA3E8AECB0FC19806CF3B40B53B95F1A34DBBD6E3ED27230324ABB3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_root_ca_key_usage_must_be_critical: 
- [historical] error e_serial_number_not_positive: 
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- is_expired

### Security Communication RootCA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 0
- SHA-256: 513B2CECB810D4CDE5DD85391ADFC6C2DD60D87BB736D2B521484AA47A0EBEF6
- SPKI SHA-256: 3380709AF3B096BE3CC2A40548142C0A520028DB09E2CB77AE2206616AB6CBB4
- Validity: 2009-05-29 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md; https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md; https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9b4e7bba-7e88-4863-923c-822e9105d662, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d3861e3c-1857-48f8-881b-4d070accedff, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2b64646d-a9d6-4a8e-8ffe-ce58fbe620ae, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c746d4bb-76f6-43a4-befa-fbd4c7f1ecdc
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: May 29 05:00:39 2009 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 513B2CECB810D4CDE5DD85391ADFC6C2DD60D87BB736D2B521484AA47A0EBEF6
    SPKI SHA256: 3380709AF3B096BE3CC2A40548142C0A520028DB09E2CB77AE2206616AB6CBB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_serial_number_not_positive: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Security Communication RootCA3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: E17C3740FD1BFE67
- SHA-256: 24A55C2AB051442D0617766541239A4AD032D7C55175AA34FFDE2FBC4F5C5294
- SPKI SHA-256: D3980AADD21638C70D74A4BB1F8AB5E11724E62ED408F9FA8D3D4D916900286B
- Validity: 2016-06-16 to 2038-01-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_CP-CPS_EN.md; https://repo1.secomtrust.net/spcpp/publicly-trusted-cpcps/SECOM_Publicly_Trusted_TLS_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2c30ae5b-f32f-489b-b176-d2add9421e45, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=61bf831f-e016-4094-867a-bb01d66e4752, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=67933f3d-217b-41d4-aded-ed68b6305328, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c746d4bb-76f6-43a4-befa-fbd4c7f1ecdc
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e1:7c:37:40:fd:1b:fe:67
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Jun 16 06:17:16 2016 GMT
            Not After : Jan 18 06:17:16 2038 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 24A55C2AB051442D0617766541239A4AD032D7C55175AA34FFDE2FBC4F5C5294
    SPKI SHA256: D3980AADD21638C70D74A4BB1F8AB5E11724E62ED408F9FA8D3D4D916900286B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Certification Authority

- Subject: countryName=JP, organizationName=Japanese Government, organizationalUnitName=Ministry of Defense, commonName=Certification Authority
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B11005CAD8E238
- SHA-256: F937385B88F659840909407B80E4EB25F25C5B4AEAEF9EE279880EE0BF05EDEF
- SPKI SHA-256: 29B431B20892B77EB7B45BF241E8455A4B2AC85AB8639FC6407A82AEE43B94F0
- Validity: 2017-03-24 to 2027-03-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:10:05:ca:d8:e2:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 24 06:40:14 2017 GMT
            Not After : Mar 24 06:40:14 2027 GMT
        Subject: C = JP, O = Japanese Government, OU = Ministry of Defense, CN = Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                92:70:06:9D:B9:28:3F:C8:31:E6:EA:59:9F:4F:3F:33:7F:C7:36:5E
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F937385B88F659840909407B80E4EB25F25C5B4AEAEF9EE279880EE0BF05EDEF
    SPKI SHA256: 29B431B20892B77EB7B45BF241E8455A4B2AC85AB8639FC6407A82AEE43B94F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### CrossTrust DV CA1

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0D5
- SHA-256: BD380028806DEECBC8336AF870B79AB74FF982C28E3E7FF09DB23630044BDED9
- SPKI SHA-256: 1FB49D65CFC81239417AA57316E89ECFD6C4643037E47D6AA0CBD6A8D8F77138
- Validity: 2011-02-24 to 2021-02-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159317 (0x12b9b0d5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Feb 24 07:11:37 2011 GMT
            Not After : Feb 24 07:11:37 2021 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust DV CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A6:F4:30:94:2F:42:CD:D9:C3:29:87:A2:AB:3F:67:B7:B9:9F:1D:1A
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BD380028806DEECBC8336AF870B79AB74FF982C28E3E7FF09DB23630044BDED9
    SPKI SHA256: 1FB49D65CFC81239417AA57316E89ECFD6C4643037E47D6AA0CBD6A8D8F77138
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### CrossTrust DV CA3

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0CE
- SHA-256: 90014BA3B9900184A84CA2A4656D03C605357F202EFF3F59176CA54C98002CB1
- SPKI SHA-256: A9F48AFB1113C924908B8864F187A37EA58C0D64C5C8D44F9A3F2B7D1A7ADAD0
- Validity: 2014-12-25 to 2024-12-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594766 (0x22b9b0ce)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 25 05:42:22 2014 GMT
            Not After : Dec 25 05:42:22 2024 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust DV CA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BD:CB:C5:95:E3:7C:BD:44:C7:56:2D:88:37:18:C9:0D:01:85:0C:4F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 90014BA3B9900184A84CA2A4656D03C605357F202EFF3F59176CA54C98002CB1
    SPKI SHA256: A9F48AFB1113C924908B8864F187A37EA58C0D64C5C8D44F9A3F2B7D1A7ADAD0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### CrossTrust DV CA4

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B139C990390946
- SHA-256: 2E6B15F9EED1EBD62D275691F93DC943F90DD1E0AF118906619C577D75298BDA
- SPKI SHA-256: 6F31715A516109BD53242F99896D035C0368F6EA0EE39921A9278C10B998A49F
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:39:c9:90:39:09:46
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 18 06:15:46 2018 GMT
            Not After : Apr 18 06:15:46 2028 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust DV CA4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BD:07:8F:1E:60:64:42:A0:F6:35:CF:A5:64:C0:41:89:72:E5:D8:06
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E6B15F9EED1EBD62D275691F93DC943F90DD1E0AF118906619C577D75298BDA
    SPKI SHA256: 6F31715A516109BD53242F99896D035C0368F6EA0EE39921A9278C10B998A49F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### CrossTrust DV CA5

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=CrossTrust DV CA5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B15323E5AEFDCD
- SHA-256: 18F4368FE93B3CAE025230BCE7EAD340FD90FB27F9A10E36FEE89FC454F22788
- SPKI SHA-256: 99FC9D40F1ADB1636561A61D683D9EA6B460C57D0C75EA00C341B9DFB90B5F39
- Validity: 2018-08-22 to 2028-08-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xtdv5/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:53:23:e5:ae:fd:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 22 07:32:24 2018 GMT
            Not After : Aug 22 07:32:24 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = CrossTrust DV CA5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                4F:8B:70:CF:A9:40:1C:96:E5:94:5D:77:AC:D6:6F:4D:2D:9B:F2:77
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 18F4368FE93B3CAE025230BCE7EAD340FD90FB27F9A10E36FEE89FC454F22788
    SPKI SHA256: 99FC9D40F1ADB1636561A61D683D9EA6B460C57D0C75EA00C341B9DFB90B5F39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### CrossTrust DV CA5

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust DV CA5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B14B1B1A00F693
- SHA-256: 3852120E01E8A21C8353378577060C4003311A27FFE07765A03F99A2C4C554DD
- SPKI SHA-256: 74DBF0965A975E7C37A94165BB34838002637DBAE8E1601EE16F115D23AA1099
- Validity: 2018-07-31 to 2028-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:4b:1b:1a:00:f6:93
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 05:26:51 2018 GMT
            Not After : Jul 31 05:26:51 2028 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust DV CA5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                ED:61:E6:B6:6F:2D:FA:3C:BA:12:4E:66:9F:97:08:E9:6B:98:B6:7D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3852120E01E8A21C8353378577060C4003311A27FFE07765A03F99A2C4C554DD
    SPKI SHA256: 74DBF0965A975E7C37A94165BB34838002637DBAE8E1601EE16F115D23AA1099
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### CrossTrust OV CA1

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0D4
- SHA-256: E8A7E08C62F40B78AA0F702CC7A6F7F0CE0BFE08609D22349890C3A58B3FFF6D
- SPKI SHA-256: A82CB611A30707C1709840E6B33B87F9B559BCC8357D2335D23F092FF3EAA05F
- Validity: 2010-10-21 to 2020-10-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159316 (0x12b9b0d4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Oct 21 05:41:18 2010 GMT
            Not After : Oct 21 05:41:18 2020 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust OV CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                32:88:4F:A1:49:8F:A9:3E:70:45:F6:CB:F3:8C:C3:BD:A6:16:9A:00
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E8A7E08C62F40B78AA0F702CC7A6F7F0CE0BFE08609D22349890C3A58B3FFF6D
    SPKI SHA256: A82CB611A30707C1709840E6B33B87F9B559BCC8357D2335D23F092FF3EAA05F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### CrossTrust OV CA3

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0CD
- SHA-256: 4CA34F710A7E10374DA506337D7563FDBD8FADA46DE8F0A6E522FD2FAC2136DB
- SPKI SHA-256: 3510CA593D38E74BF9A29EA0BECE352A857708BB5B0FCFBCB7C229855AC8BEA3
- Validity: 2014-12-25 to 2024-12-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594765 (0x22b9b0cd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 25 05:36:22 2014 GMT
            Not After : Dec 25 05:36:22 2024 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust OV CA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AC:C2:A9:B5:D9:A6:96:84:E7:93:2D:BE:14:96:AA:AD:4C:1D:49:8C
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4CA34F710A7E10374DA506337D7563FDBD8FADA46DE8F0A6E522FD2FAC2136DB
    SPKI SHA256: 3510CA593D38E74BF9A29EA0BECE352A857708BB5B0FCFBCB7C229855AC8BEA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### CrossTrust OV CA4

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B137346B15370E
- SHA-256: 455B5FA6D6A472E23F0AC0F1C14AA3F5E80553203CA7FF4280FC1125054574FD
- SPKI SHA-256: EDCBF0EEED47E350FA60401B2F06F8D1C6F6DB10B88564F518925E75B55DB155
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:37:34:6b:15:37:0e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 18 05:52:37 2018 GMT
            Not After : Apr 18 05:52:37 2028 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust OV CA4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                41:A1:DC:2E:85:0A:3D:A5:CE:AE:90:90:B9:58:68:16:3E:AE:C0:80
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 455B5FA6D6A472E23F0AC0F1C14AA3F5E80553203CA7FF4280FC1125054574FD
    SPKI SHA256: EDCBF0EEED47E350FA60401B2F06F8D1C6F6DB10B88564F518925E75B55DB155
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### CrossTrust OV CA5

- Subject: countryName=JP, organizationName=CrossTrust, commonName=CrossTrust OV CA5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B14A3A611FD0D8
- SHA-256: 9EA0680D50BC63F26DEEFDC96279FA182A357D3231D761BBFA3D584277D4F0ED
- SPKI SHA-256: C3A33D470185D2D399B748DB90B835F4FD149FDE348E2DC8F98CF99BD9D76956
- Validity: 2018-07-31 to 2028-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:4a:3a:61:1f:d0:d8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 05:17:35 2018 GMT
            Not After : Jul 31 05:17:35 2028 GMT
        Subject: C = JP, O = CrossTrust, CN = CrossTrust OV CA5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                15:1D:90:35:53:43:15:45:59:B4:43:48:DC:AE:0B:72:99:7C:7C:64
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9EA0680D50BC63F26DEEFDC96279FA182A357D3231D761BBFA3D584277D4F0ED
    SPKI SHA256: C3A33D470185D2D399B748DB90B835F4FD149FDE348E2DC8F98CF99BD9D76956
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### CrossTrust OV CA5

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=CrossTrust OV CA5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B152643B58B011
- SHA-256: 79C4091B05B15C1683128B7A355E0AAD62E1BBBC3E5F3735370C06CC4D1AFB44
- SPKI SHA-256: F50992B364D1981B815D7A513E1A26FB6CB9E3F450DCAB0AE2D7BF2440FA8344
- Validity: 2018-08-22 to 2028-08-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xtov5/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:52:64:3b:58:b0:11
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 22 07:23:58 2018 GMT
            Not After : Aug 22 07:23:58 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = CrossTrust OV CA5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                24:B7:B4:41:D4:32:4F:C4:19:FF:5E:62:64:3B:5E:69:27:61:17:DC
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 79C4091B05B15C1683128B7A355E0AAD62E1BBBC3E5F3735370C06CC4D1AFB44
    SPKI SHA256: F50992B364D1981B815D7A513E1A26FB6CB9E3F450DCAB0AE2D7BF2440FA8344
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Cybertrust Japan SureMail CA G4

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureMail CA G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B19C1EDAB9E6BF666D11365E948E
- SHA-256: BEA27C18D65948D8C61D582447B3747774609391A7E961CFA82331070BA6E77E
- SPKI SHA-256: 3382CF44F6D33C0DC01A373D25D554A7D126DB8A000F92A36AEF11D3CF73001F
- Validity: 2023-07-31 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: https://www.cybertrust.ne.jp/ssl/repository/SMCPCPS_English.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c03c81fa-b455-4eb6-b45f-8d463d203f71
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureMail/smcag4/cdp.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:9c:1e:da:b9:e6:bf:66:6d:11:36:5e:94:8e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 04:35:12 2023 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureMail CA G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FC:C6:DA:FE:C7:AD:D5:5A:CE:48:DE:CF:FD:E8:28:C5:A3:BA:8F:11
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.1
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BEA27C18D65948D8C61D582447B3747774609391A7E961CFA82331070BA6E77E
    SPKI SHA256: 3382CF44F6D33C0DC01A373D25D554A7D126DB8A000F92A36AEF11D3CF73001F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cybertrust Japan SureMail CA G4_2019-2025

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureMail CA G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1655C8E69915B
- SHA-256: 73609E68EEAA8B52808CB503FB8EA64EDD38923DA9C55AE788051AB416DD759E
- SPKI SHA-256: 3382CF44F6D33C0DC01A373D25D554A7D126DB8A000F92A36AEF11D3CF73001F
- Validity: 2019-09-27 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureMail/smcag4/cdp.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:65:5c:8e:69:91:5b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep 27 02:14:09 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureMail CA G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FC:C6:DA:FE:C7:AD:D5:5A:CE:48:DE:CF:FD:E8:28:C5:A3:BA:8F:11
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 73609E68EEAA8B52808CB503FB8EA64EDD38923DA9C55AE788051AB416DD759E
    SPKI SHA256: 3382CF44F6D33C0DC01A373D25D554A7D126DB8A000F92A36AEF11D3CF73001F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cybertrust Japan SureMail CA G5

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureMail CA G5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1A9879D5579E8F30B8A2BD374D7
- SHA-256: 995C3C64F32348142BF1EBEAF7370781A1C30682DE02AD85FB2700CE1395F737
- SPKI SHA-256: 8D0C420B4201A6ECE9B16B2C3E6B4DE2C324B521C5B11FAF3EEFBF9F47D892D8
- Validity: 2024-12-17 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: https://www.cybertrust.ne.jp/ssl/repository/SMCPCPS_English.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c03c81fa-b455-4eb6-b45f-8d463d203f71
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureMail/smcag5/cdp.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.3, 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:a9:87:9d:55:79:e8:f3:0b:8a:2b:d3:74:d7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 17 05:02:47 2024 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureMail CA G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                8B:BE:68:00:E7:EB:1B:21:CA:50:05:86:A2:F9:24:E1:24:A0:DA:4D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.3
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 995C3C64F32348142BF1EBEAF7370781A1C30682DE02AD85FB2700CE1395F737
    SPKI SHA256: 8D0C420B4201A6ECE9B16B2C3E6B4DE2C324B521C5B11FAF3EEFBF9F47D892D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.3, 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cybertrust Japan SureServer CA G4

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer CA G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1630CECB43C2E
- SHA-256: 0207056D172C80BDFB6DC45BE9E5808846078D1E6EEF1B6ED70259AB332A64C1
- SPKI SHA-256: AD2E04C7B7CCCFD750860741EAA8F13FE8C9250C2321E6FEED186FBDD3BAC72F
- Validity: 2019-09-27 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: https://www.cybertrust.ne.jp/ssl/repository/TLSCPCPS_English.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2bbb627a-8f23-4fe0-8676-61c4a1b882b6
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureServer/ovcag4/cdp.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:63:0c:ec:b4:3c:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep 27 01:54:23 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureServer CA G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                62:A7:D2:DA:DE:85:B6:92:F1:85:BC:F6:E8:95:9D:75:A0:FA:4E:1F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0207056D172C80BDFB6DC45BE9E5808846078D1E6EEF1B6ED70259AB332A64C1
    SPKI SHA256: AD2E04C7B7CCCFD750860741EAA8F13FE8C9250C2321E6FEED186FBDD3BAC72F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cybertrust Japan SureServer CA G4

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer CA G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1A074641857F7A01332DB42B9EC
- SHA-256: 8346922CB8730BB6AE71AB03BFC42462F4160423D9079BE64385621AC5877672
- SPKI SHA-256: AD2E04C7B7CCCFD750860741EAA8F13FE8C9250C2321E6FEED186FBDD3BAC72F
- Validity: 2023-12-13 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: https://www.cybertrust.ne.jp/ssl/repository/TLSCPCPS_English.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2bbb627a-8f23-4fe0-8676-61c4a1b882b6
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureServer/ovcag4/cdp.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:a0:74:64:18:57:f7:a0:13:32:db:42:b9:ec
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 13 05:57:30 2023 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureServer CA G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                62:A7:D2:DA:DE:85:B6:92:F1:85:BC:F6:E8:95:9D:75:A0:FA:4E:1F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8346922CB8730BB6AE71AB03BFC42462F4160423D9079BE64385621AC5877672
    SPKI SHA256: AD2E04C7B7CCCFD750860741EAA8F13FE8C9250C2321E6FEED186FBDD3BAC72F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cybertrust Japan SureServer EV CA G3

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer EV CA G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1A12D91F181AD7A7B6DBEB38EA7
- SHA-256: B723273A3506C6BED85F083DA562734BE09F2C47ADE47317831D63AA8BE278A5
- SPKI SHA-256: CC9A1EA68CBEED7789A119A36D1EFF8BCA19D5612E8CE2864C3F4D34CD2E5873
- Validity: 2023-12-13 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: https://www.cybertrust.ne.jp/ssl/repository/TLSCPCPS_English.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2bbb627a-8f23-4fe0-8676-61c4a1b882b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4fb74a06-3d95-4780-b361-fc6ebcc9f85a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureServer/evcag3/cdp.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.2.392.200091.100.721.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:a1:2d:91:f1:81:ad:7a:7b:6d:be:b3:8e:a7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 13 06:28:45 2023 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureServer EV CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                82:6C:75:5D:53:F5:45:69:BC:25:2D:A4:4C:89:E6:B2:B7:41:87:A3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.2.392.200091.100.721.1
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B723273A3506C6BED85F083DA562734BE09F2C47ADE47317831D63AA8BE278A5
    SPKI SHA256: CC9A1EA68CBEED7789A119A36D1EFF8BCA19D5612E8CE2864C3F4D34CD2E5873
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.2.392.200091.100.721.1
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Cybertrust Japan SureServer EV CA G3

- Subject: countryName=JP, organizationName=Cybertrust Japan Co., Ltd., commonName=Cybertrust Japan SureServer EV CA G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B16488BCE695FC
- SHA-256: FECE9ADA7AA49D4FEA9EFF123542095A880C004FD6933F9364B02B2E3574EA38
- SPKI SHA-256: CC9A1EA68CBEED7789A119A36D1EFF8BCA19D5612E8CE2864C3F4D34CD2E5873
- Validity: 2019-09-27 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Cybertrust Japan Co., Ltd.
- CP/CPS: https://www.cybertrust.ne.jp/ssl/repository/TLSCPCPS_English.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4c5a1d91-0335-4c98-9ad9-33cc3f7504d8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2300bc04-54fc-49d2-b8d0-bfd001e13279, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2bbb627a-8f23-4fe0-8676-61c4a1b882b6, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=4fb74a06-3d95-4780-b361-fc6ebcc9f85a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.cybertrust.ne.jp/SureServer/evcag3/cdp.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.721.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:64:88:bc:e6:95:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep 27 02:04:20 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Cybertrust Japan Co., Ltd.", CN = Cybertrust Japan SureServer EV CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                82:6C:75:5D:53:F5:45:69:BC:25:2D:A4:4C:89:E6:B2:B7:41:87:A3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.721.1
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FECE9ADA7AA49D4FEA9EFF123542095A880C004FD6933F9364B02B2E3574EA38
    SPKI SHA256: CC9A1EA68CBEED7789A119A36D1EFF8BCA19D5612E8CE2864C3F4D34CD2E5873
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.721.1
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EINS/PKI Public Certification Authority V2

- Subject: countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0F1
- SHA-256: 8FE9772390F6D22A953D98DBCD19754ACBD340920B0C70DDCA1FEFE487329750
- SPKI SHA-256: 5005E10AC23C5452F628500CC842B57D14BEE17A3D3FC4FEABE64C70905FBDCB
- Validity: 2013-12-24 to 2023-12-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159345 (0x12b9b0f1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Dec 24 05:23:04 2013 GMT
            Not After : Dec 24 05:23:04 2023 GMT
        Subject: C = JP, O = INTEC INC., CN = EINS/PKI Public Certification Authority V2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DC:FE:B5:80:98:19:14:AC:8D:AA:B3:80:43:C5:20:75:65:26:CE:8F
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8FE9772390F6D22A953D98DBCD19754ACBD340920B0C70DDCA1FEFE487329750
    SPKI SHA256: 5005E10AC23C5452F628500CC842B57D14BEE17A3D3FC4FEABE64C70905FBDCB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### EINS/PKI Public Certification Authority V3

- Subject: countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0CA
- SHA-256: 3D0C2B38E85CAF49C383B6C3328640E5FBE86ECFA29FAB137151ACD1B42ED149
- SPKI SHA-256: 46709042CF62A74BF2AE1181B76A20733364493AA9B9809786A8082F44591964
- Validity: 2014-12-16 to 2024-12-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594762 (0x22b9b0ca)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 16 07:16:00 2014 GMT
            Not After : Dec 16 07:16:00 2024 GMT
        Subject: C = JP, O = INTEC INC., CN = EINS/PKI Public Certification Authority V3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                62:39:30:D5:7C:64:3D:88:16:FB:9E:1D:8B:BE:73:87:02:5B:2E:0D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3D0C2B38E85CAF49C383B6C3328640E5FBE86ECFA29FAB137151ACD1B42ED149
    SPKI SHA256: 46709042CF62A74BF2AE1181B76A20733364493AA9B9809786A8082F44591964
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### EINS/PKI Public Certification Authority V3

- Subject: countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1300602CE60BE
- SHA-256: 697E41A85A253C765A31EB180F78C7F104749D662C1A534C843B0E583805BE37
- SPKI SHA-256: 56AAE5E96F4A18FFABEE0B435F881BB7E9FA2D5E850877150DC44544B25BAEB1
- Validity: 2018-03-22 to 2028-03-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:30:06:02:ce:60:be
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 22 06:23:20 2018 GMT
            Not After : Mar 22 06:23:20 2028 GMT
        Subject: C = JP, O = INTEC INC., CN = EINS/PKI Public Certification Authority V3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                05:E0:7E:5F:7C:06:66:0E:EB:B3:ED:D4:6A:21:17:D3:6A:18:75:C1
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 697E41A85A253C765A31EB180F78C7F104749D662C1A534C843B0E583805BE37
    SPKI SHA256: 56AAE5E96F4A18FFABEE0B435F881BB7E9FA2D5E850877150DC44544B25BAEB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### EINS/PKI Public Certification Authority V4

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=EINS/PKI Public Certification Authority V4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B151ED4CA1E8DA
- SHA-256: 38B26CF45C932EA28019D93E440AC72BAE83F9CBF52D6AD913698B18FCC8717D
- SPKI SHA-256: 84C069DA6E0FBE88C295D7ECAF3A17E1D3E4FFD31CB661C964B5194EA3E60589
- Validity: 2018-08-22 to 2028-08-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/intecca3/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:51:ed:4c:a1:e8:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 22 07:15:21 2018 GMT
            Not After : Aug 22 07:15:21 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = EINS/PKI Public Certification Authority V4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0A:42:E6:B6:34:B9:2D:BB:FE:E0:B9:94:ED:16:6A:82:1D:3C:0C:2C
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 38B26CF45C932EA28019D93E440AC72BAE83F9CBF52D6AD913698B18FCC8717D
    SPKI SHA256: 84C069DA6E0FBE88C295D7ECAF3A17E1D3E4FFD31CB661C964B5194EA3E60589
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### EINS/PKI Public Certification Authority V4

- Subject: countryName=JP, organizationName=INTEC INC., commonName=EINS/PKI Public Certification Authority V4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1493D858728F9
- SHA-256: 5943C5CDB5E1925315D0AB71AA4A82F6696F3719A22211EA7D53C01C558BC4EA
- SPKI SHA-256: 16BFC20BB227A0897111E499905DC28BF04AEC7B8C76D8F20E26CBBF82185A3F
- Validity: 2018-07-31 to 2028-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:49:3d:85:87:28:f9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 05:08:05 2018 GMT
            Not After : Jul 31 05:08:05 2028 GMT
        Subject: C = JP, O = INTEC INC., CN = EINS/PKI Public Certification Authority V4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DE:C8:71:C7:BF:A5:D1:F7:99:01:49:24:93:85:5C:D6:7B:D1:F4:94
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5943C5CDB5E1925315D0AB71AA4A82F6696F3719A22211EA7D53C01C558BC4EA
    SPKI SHA256: 16BFC20BB227A0897111E499905DC28BF04AEC7B8C76D8F20E26CBBF82185A3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fnet CA

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fnet CA
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority 2
- Serial: 0189948EE115FA05B8
- SHA-256: 83F2CE81F2F26E0ECAB52A95935E9B433CF104FD0F39143D655EC3D4CD36B56F
- SPKI SHA-256: A6EA8E4A426D6DE1935747E11A0C6F94EF6548A2B5691D72EA8AB22458A8322E
- Validity: 2012-06-20 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://caps.fujixerox.co.jp/crl/fxca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:94:8e:e1:15:fa:05:b8
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority 2
        Validity
            Not Before: Jun 20 15:00:00 2012 GMT
            Not After : Mar 31 10:43:04 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fnet CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                16:E4:13:D6:F0:C2:D0:A2:79:3B:08:82:12:54:08:53:9A:48:65:EA
            X509v3 Authority Key Identifier:
                01:BA:D4:92:61:0F:B7:16:E9:E8:33:14:8A:E4:5C:89:C4:5C:B1:96
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.297.1.5.1.12
                  CPS: http://www.fujixerox.co.jp/product/cap/fxca2.html
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://caps.fujixerox.co.jp/crl/fxca2.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 83F2CE81F2F26E0ECAB52A95935E9B433CF104FD0F39143D655EC3D4CD36B56F
    SPKI SHA256: A6EA8E4A426D6DE1935747E11A0C6F94EF6548A2B5691D72EA8AB22458A8322E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.12
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://caps.fujixerox.co.jp/crl/fxca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Fuji Xerox Certification Authority - G2_2011-2021

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority - G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0A4
- SHA-256: 1FD31C66B0B45F93E66709365D760BF670276B1D39CF8E7068D4A8E20BBFF3E0
- SPKI SHA-256: C1E92F8A9671F7A9B301E9BB8D7CDA73879AA7327490C7427EDBF834F0895872
- Validity: 2011-03-31 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594724 (0x22b9b0a4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 31 11:52:44 2011 GMT
            Not After : Mar 31 11:52:44 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                1E:89:C4:2F:A6:2F:3C:EE:A4:7F:F6:B3:BE:40:C1:23:5B:E0:D5:36
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1FD31C66B0B45F93E66709365D760BF670276B1D39CF8E7068D4A8E20BBFF3E0
    SPKI SHA256: C1E92F8A9671F7A9B301E9BB8D7CDA73879AA7327490C7427EDBF834F0895872
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Fuji Xerox Certification Authority 2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority 2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0D7
- SHA-256: 301C767502761A9098936F6CAA736C43640741E0DD9A2698F43A001D97C167F9
- SPKI SHA-256: 8C46A4188D63382F4CEEDD69EDBFDCA7B38EB85B76A2F469A20456AD157142DF
- Validity: 2011-03-31 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159319 (0x12b9b0d7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Mar 31 10:43:04 2011 GMT
            Not After : Mar 31 10:43:04 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                01:BA:D4:92:61:0F:B7:16:E9:E8:33:14:8A:E4:5C:89:C4:5C:B1:96
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 301C767502761A9098936F6CAA736C43640741E0DD9A2698F43A001D97C167F9
    SPKI SHA256: 8C46A4188D63382F4CEEDD69EDBFDCA7B38EB85B76A2F469A20456AD157142DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Fuji Xerox Certification Authority-PB

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority-PB
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B161A36494FB7B
- SHA-256: FF64997909085D4B747AF303378641008D5745A9162EB345A0835A51F60913F6
- SPKI SHA-256: 384B464714D464FF584CE1CF85EFA57ADA20F35C2122778C82B76FBC75C5E5B0
- Validity: 2019-07-24 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Fuji Xerox
- CP/CPS: https://repo1.secomtrust.net/sppca/xerox/fxprdcapb/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/fxprdcapb/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:61:a3:64:94:fb:7b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 24 06:45:35 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority-PB
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E7:35:0A:ED:52:DE:4C:BA:7F:0C:CA:9C:83:C5:A4:B1:11:38:58:4F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FF64997909085D4B747AF303378641008D5745A9162EB345A0835A51F60913F6
    SPKI SHA256: 384B464714D464FF584CE1CF85EFA57ADA20F35C2122778C82B76FBC75C5E5B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fuji Xerox Certification Authority-PB

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority-PB
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B15A9B8FF55573
- SHA-256: B8262B111733E231C4E6D4EB404BDAF8E956931E552333078A3B84ACF1D461C3
- SPKI SHA-256: 384B464714D464FF584CE1CF85EFA57ADA20F35C2122778C82B76FBC75C5E5B0
- Validity: 2019-03-28 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:5a:9b:8f:f5:55:73
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 28 06:42:55 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority-PB
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E7:35:0A:ED:52:DE:4C:BA:7F:0C:CA:9C:83:C5:A4:B1:11:38:58:4F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Name Constraints:
                Permitted:
                  DNS:fujixerox.co.jp
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B8262B111733E231C4E6D4EB404BDAF8E956931E552333078A3B84ACF1D461C3
    SPKI SHA256: 384B464714D464FF584CE1CF85EFA57ADA20F35C2122778C82B76FBC75C5E5B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fuji Xerox Endorsement CA - G2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Endorsement CA - G2
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority - G2
- Serial: 01BE5B7F2187D560C0
- SHA-256: 62F4FB785A2C29E109DF1031EF484C24446B924A074004E9E383CA647F8EB0BA
- SPKI SHA-256: 4C76783BA998EA372589D73D4DC236820381E8A8E0AA9D587EDD5051EDC0DE35
- Validity: 2011-04-17 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.8
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://caps.fujixerox.co.jp/crl/fxca-g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:be:5b:7f:21:87:d5:60:c0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority - G2
        Validity
            Not Before: Apr 17 15:00:00 2011 GMT
            Not After : Mar 31 11:52:44 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Endorsement CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                AD:9B:1A:7D:5C:B7:4A:A1:A9:67:64:F6:3E:4A:C4:EF:11:0F:3F:50
            X509v3 Authority Key Identifier:
                1E:89:C4:2F:A6:2F:3C:EE:A4:7F:F6:B3:BE:40:C1:23:5B:E0:D5:36
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.297.1.5.1.8
                  CPS: http://www.fujixerox.co.jp/product/cap/fxca-g2.html
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://caps.fujixerox.co.jp/crl/fxca-g2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 62F4FB785A2C29E109DF1031EF484C24446B924A074004E9E383CA647F8EB0BA
    SPKI SHA256: 4C76783BA998EA372589D73D4DC236820381E8A8E0AA9D587EDD5051EDC0DE35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.8
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://caps.fujixerox.co.jp/crl/fxca-g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Fuji Xerox Endorsement CA 2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Endorsement CA 2
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority 2
- Serial: 0146B8ECF390D5D379
- SHA-256: 9526E37DCD3BBC3AF02721942DC40C8D4D1325F59FFB5D7F4D071404B0775EEF
- SPKI SHA-256: B2098F183F2229E462044583ABEFEABDB3A752BAE7BE8D0927211A64756ABD8A
- Validity: 2011-04-17 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://caps.fujixerox.co.jp/crl/fxca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:46:b8:ec:f3:90:d5:d3:79
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority 2
        Validity
            Not Before: Apr 17 15:00:00 2011 GMT
            Not After : Mar 31 10:43:04 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Endorsement CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BE:C4:C8:14:E0:0E:0B:5A:45:A1:11:1C:3C:DA:0E:08:4A:9C:79:AF
            X509v3 Authority Key Identifier:
                01:BA:D4:92:61:0F:B7:16:E9:E8:33:14:8A:E4:5C:89:C4:5C:B1:96
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.297.1.5.1.12
                  CPS: http://www.fujixerox.co.jp/product/cap/fxca2.html
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://caps.fujixerox.co.jp/crl/fxca2.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9526E37DCD3BBC3AF02721942DC40C8D4D1325F59FFB5D7F4D071404B0775EEF
    SPKI SHA256: B2098F183F2229E462044583ABEFEABDB3A752BAE7BE8D0927211A64756ABD8A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.12
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://caps.fujixerox.co.jp/crl/fxca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Fuji Xerox Product CA - S

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Product CA - S
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0E70024E41D45
- SHA-256: 80042563DB5F162E455632B589C60150F37EF7FEDB774C6DC2ED5BA6FB865120
- SPKI SHA-256: 702F8C99F42327AFA11F09E4D5D751FCA8B53A6A73D493084B0E5D91A01C5875
- Validity: 2015-09-18 to 2025-09-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:e7:00:24:e4:1d:45
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep 18 05:03:21 2015 GMT
            Not After : Sep 18 05:03:21 2025 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Product CA - S
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FB:1E:32:D0:74:12:4F:71:F6:9B:9D:58:D8:31:84:1B:9E:31:20:E3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 80042563DB5F162E455632B589C60150F37EF7FEDB774C6DC2ED5BA6FB865120
    SPKI SHA256: 702F8C99F42327AFA11F09E4D5D751FCA8B53A6A73D493084B0E5D91A01C5875
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Fuji Xerox Product CA 2 - S

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Product CA 2 - S
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B13B804FBBC401
- SHA-256: 0F55F2888D163CAC5A0B68E6CEC1098C582C3CEE038947ABCA26D6321A66AD8F
- SPKI SHA-256: 541E61B95BF3DCD22EBDBE89A1B0B4F5327E678B4ABD53AEAAF2D9EE6F7BF76C
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:3b:80:4f:bb:c4:01
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 18 06:34:14 2018 GMT
            Not After : Apr 18 06:34:14 2028 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Product CA 2 - S
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D6:6B:31:DD:FD:6C:B2:8A:41:77:E5:D7:E0:54:CF:53:4F:DA:2F:7F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F55F2888D163CAC5A0B68E6CEC1098C582C3CEE038947ABCA26D6321A66AD8F
    SPKI SHA256: 541E61B95BF3DCD22EBDBE89A1B0B4F5327E678B4ABD53AEAAF2D9EE6F7BF76C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fuji Xerox Product CA-PB

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Product CA-PB
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority-PB
- Serial: 24480464D1B2F49C9101F05F1A096608
- SHA-256: 3D40B50D908522F85379A7E0FEF1B12EAF9D7D41CD418DA08251D1DBECAB1C24
- SPKI SHA-256: C52D8C989DF4B20350B7FE86D3937FC4C06B5766C68DC22C49062415CE60A3D9
- Validity: 2019-07-24 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/sppca/xerox/fxprdcapb/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/fxprdcapb/fullcrl.crl
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.110.216.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://fxcapb.ocsp.secomtrust.net
- CRL DP: http://repo1.secomtrust.net/sppca/xerox/fxcapb/fullcrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:48:04:64:d1:b2:f4:9c:91:01:f0:5f:1a:09:66:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority-PB
        Validity
            Not Before: Jul 24 07:17:09 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Product CA-PB
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                E7:35:0A:ED:52:DE:4C:BA:7F:0C:CA:9C:83:C5:A4:B1:11:38:58:4F
            Authority Information Access:
                OCSP - URI:http://fxcapb.ocsp.secomtrust.net
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.110.216.4
                  CPS: https://repo1.secomtrust.net/sppca/xerox/fxcapb/
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/sppca/xerox/fxcapb/fullcrl.crl
            X509v3 Subject Key Identifier:
                31:B8:0D:D6:CC:21:FA:49:03:DB:47:B6:14:40:EA:17:9F:AF:42:79
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3D40B50D908522F85379A7E0FEF1B12EAF9D7D41CD418DA08251D1DBECAB1C24
    SPKI SHA256: C52D8C989DF4B20350B7FE86D3937FC4C06B5766C68DC22C49062415CE60A3D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.110.216.4
- AIA OCSP: http://fxcapb.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repo1.secomtrust.net/sppca/xerox/fxcapb/fullcrl.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fuji Xerox Xnet CA - C

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - C
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B189472DB5B5D9F88B141544C058
- SHA-256: B8A64F8DED31E75B08133E714A68055B7A646654F0E6CBBE847C9AF1290E9674
- SPKI SHA-256: 45CB5CC7F7E2691443A54722B64DEF3F3D59503EE8E6C57E2C703461DC97565E
- Validity: 2021-06-29 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/sppca/xerox/xnetcac/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/xnetcac/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:89:47:2d:b5:b5:d9:f8:8b:14:15:44:c0:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jun 29 06:06:12 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA - C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C1:C4:E2:A9:18:B9:63:7B:1F:5E:2F:F8:0E:A7:63:D3:57:7A:31:30
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B8A64F8DED31E75B08133E714A68055B7A646654F0E6CBBE847C9AF1290E9674
    SPKI SHA256: 45CB5CC7F7E2691443A54722B64DEF3F3D59503EE8E6C57E2C703461DC97565E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fuji Xerox Xnet CA - C

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - C
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0FD01F8C34026
- SHA-256: C23D01B8E9585613E260EC8EA485BFF8F5987298D5FC02C07064C5446223F9C7
- SPKI SHA-256: 45CB5CC7F7E2691443A54722B64DEF3F3D59503EE8E6C57E2C703461DC97565E
- Validity: 2016-09-08 to 2026-09-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:fd:01:f8:c3:40:26
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep  8 04:58:20 2016 GMT
            Not After : Sep  8 04:58:20 2026 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA - C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C1:C4:E2:A9:18:B9:63:7B:1F:5E:2F:F8:0E:A7:63:D3:57:7A:31:30
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C23D01B8E9585613E260EC8EA485BFF8F5987298D5FC02C07064C5446223F9C7
    SPKI SHA256: 45CB5CC7F7E2691443A54722B64DEF3F3D59503EE8E6C57E2C703461DC97565E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### Fuji Xerox Xnet CA - G2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - G2
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority - G2
- Serial: 019513F1DEDC5E874B
- SHA-256: 5CEDA991F13646D732DFCDF6C10B636A5971F454B107172CC03B5BEE4D2906BB
- SPKI SHA-256: 49605E6EF96C2EE954844F6D7FC67545B21C4C963E90B8573BFB0007ADCCEAD0
- Validity: 2015-08-12 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.8
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://caps.fujixerox.co.jp/crl/fxca-g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:95:13:f1:de:dc:5e:87:4b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority - G2
        Validity
            Not Before: Aug 12 15:00:00 2015 GMT
            Not After : Mar 31 11:52:44 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E5:BC:48:2E:91:B0:2B:FE:3D:3B:AB:E4:7A:1D:60:53:73:B0:D1:AF
            X509v3 Authority Key Identifier:
                1E:89:C4:2F:A6:2F:3C:EE:A4:7F:F6:B3:BE:40:C1:23:5B:E0:D5:36
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.297.1.5.1.8
                  CPS: http://www.fujixerox.co.jp/product/cap/fxca-g2.html
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://caps.fujixerox.co.jp/crl/fxca-g2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5CEDA991F13646D732DFCDF6C10B636A5971F454B107172CC03B5BEE4D2906BB
    SPKI SHA256: 49605E6EF96C2EE954844F6D7FC67545B21C4C963E90B8573BFB0007ADCCEAD0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.8
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://caps.fujixerox.co.jp/crl/fxca-g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_key_usage_not_critical: 
- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_ext_key_usage_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Fuji Xerox Xnet CA - S

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - S
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0E6212893CE16
- SHA-256: 14510AB217FDDD20FA3CE2F171583A44C5C53F6CAD0886BAD0A91CFB666632D8
- SPKI SHA-256: 8003B72618E2033D597F4A68F9C64BDC4139F81F2576443DE823242C0EA9C227
- Validity: 2015-09-18 to 2025-09-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:e6:21:28:93:ce:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep 18 04:57:25 2015 GMT
            Not After : Sep 18 04:57:25 2025 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA - S
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F4:2B:E7:9D:57:27:8D:0A:85:E0:1C:29:9A:F8:98:CA:39:93:EF:3D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 14510AB217FDDD20FA3CE2F171583A44C5C53F6CAD0886BAD0A91CFB666632D8
    SPKI SHA256: 8003B72618E2033D597F4A68F9C64BDC4139F81F2576443DE823242C0EA9C227
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Fuji Xerox Xnet CA - S2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - S2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1833F76FC4E10BB248488B8E4CC
- SHA-256: FEEA2389D4F7272B024F51AF71E8FE84AA543698D015C1D241793595D6209FB9
- SPKI SHA-256: 07BFF08B9057F9C82B67CB8EB98BB02F3D9C165C911AE08A086F10848D7703FF
- Validity: 2020-10-16 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/sppca/xerox/xnetcas2/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/xnetcas2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:83:3f:76:fc:4e:10:bb:24:84:88:b8:e4:cc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Oct 16 09:08:31 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA - S2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                00:71:6B:D4:0D:11:6C:14:78:B3:49:25:8C:0F:F7:7E:DD:A0:F1:6B
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:fujixerox.co.jp
                  DNS:fujixerox.com
                  DNS:fujixerox.net
                  DNS:fxis.co.jp
                  DNS:fxsvl.co.jp
                  DNS:fxmfg.co.jp
                  DNS:fxsc.co.jp
                  DNS:cresite.jp
                  DNS:skydesk.jp
                  DirName:C = JP, ST = Kanagawa, L = Yokohama, O = "Fuji Xerox Co., Ltd."
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FEEA2389D4F7272B024F51AF71E8FE84AA543698D015C1D241793595D6209FB9
    SPKI SHA256: 07BFF08B9057F9C82B67CB8EB98BB02F3D9C165C911AE08A086F10848D7703FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Fuji Xerox Xnet CA - S2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA - S2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B13AF2D9E4F386
- SHA-256: 48E5A5E264A3CF261BBFE032EDDE1DD8B4B4B0F5DD0DD0C9FD85D86D783F7CC9
- SPKI SHA-256: 07BFF08B9057F9C82B67CB8EB98BB02F3D9C165C911AE08A086F10848D7703FF
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/xnetcas2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:3a:f2:d9:e4:f3:86
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 18 06:24:51 2018 GMT
            Not After : Apr 18 06:24:51 2028 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA - S2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                00:71:6B:D4:0D:11:6C:14:78:B3:49:25:8C:0F:F7:7E:DD:A0:F1:6B
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 48E5A5E264A3CF261BBFE032EDDE1DD8B4B4B0F5DD0DD0C9FD85D86D783F7CC9
    SPKI SHA256: 07BFF08B9057F9C82B67CB8EB98BB02F3D9C165C911AE08A086F10848D7703FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Fuji Xerox Xnet CA 2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Xnet CA 2
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority 2
- Serial: 017BAD835FB491FD26
- SHA-256: 6A547437B1F52B72A72CC730193A873CA9B3D03E3992B1A3FAEC10A78054E2A1
- SPKI SHA-256: 2E7A4B0602A8BA100F76F90B978764F7B1D47611462CEFF8DD306C28D6A3740E
- Validity: 2012-06-20 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://caps.fujixerox.co.jp/crl/fxca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:7b:ad:83:5f:b4:91:fd:26
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority 2
        Validity
            Not Before: Jun 20 15:00:00 2012 GMT
            Not After : Mar 31 10:43:04 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = Fuji Xerox Xnet CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                93:3D:3B:F7:C5:AF:5E:C6:05:CE:82:90:08:BE:CB:C0:50:96:D3:F2
            X509v3 Authority Key Identifier:
                01:BA:D4:92:61:0F:B7:16:E9:E8:33:14:8A:E4:5C:89:C4:5C:B1:96
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.297.1.5.1.12
                  CPS: http://www.fujixerox.co.jp/product/cap/fxca2.html
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://caps.fujixerox.co.jp/crl/fxca2.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6A547437B1F52B72A72CC730193A873CA9B3D03E3992B1A3FAEC10A78054E2A1
    SPKI SHA256: 2E7A4B0602A8BA100F76F90B978764F7B1D47611462CEFF8DD306C28D6A3740E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.12
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://caps.fujixerox.co.jp/crl/fxca2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### FUJIFILM Fnet CA - C

- Subject: countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - C
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18A94596482703CAC81DBEB4ABD
- SHA-256: 8A3F5C460B6FF81C7AAE21A9081BB0609AB957AA1150521EEE68BD38B894BB65
- SPKI SHA-256: 045D0CEAAE472B712E7323EE318875F8FDADCA45A51569F2CE516BCC542ABC64
- Validity: 2021-06-29 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: FUJIFILM
- CP/CPS: https://repo1.secomtrust.net/sppca/ff/fnetcac/Fnet_CA-C_CP-CPS_EN.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/ff/fnetcac/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:8a:94:59:64:82:70:3c:ac:81:db:eb:4a:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jun 29 06:36:24 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = FUJIFILM, CN = FUJIFILM Fnet CA - C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                79:0C:38:64:9F:35:42:E4:EC:42:7A:24:C2:33:2D:FB:E0:B3:5C:96
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8A3F5C460B6FF81C7AAE21A9081BB0609AB957AA1150521EEE68BD38B894BB65
    SPKI SHA256: 045D0CEAAE472B712E7323EE318875F8FDADCA45A51569F2CE516BCC542ABC64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### FUJIFILM Fnet CA - C

- Subject: countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - C
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0FE87D89D73CC
- SHA-256: B6AB8DB110B5F6D35FD9A6B5FF7071D8426658126C425629BC7CDA31354F4CD0
- SPKI SHA-256: 045D0CEAAE472B712E7323EE318875F8FDADCA45A51569F2CE516BCC542ABC64
- Validity: 2016-09-08 to 2026-09-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:fe:87:d8:9d:73:cc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep  8 05:08:05 2016 GMT
            Not After : Sep  8 05:08:05 2026 GMT
        Subject: C = JP, O = FUJIFILM, CN = FUJIFILM Fnet CA - C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                79:0C:38:64:9F:35:42:E4:EC:42:7A:24:C2:33:2D:FB:E0:B3:5C:96
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B6AB8DB110B5F6D35FD9A6B5FF7071D8426658126C425629BC7CDA31354F4CD0
    SPKI SHA256: 045D0CEAAE472B712E7323EE318875F8FDADCA45A51569F2CE516BCC542ABC64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### FUJIFILM Fnet CA - G2

- Subject: countryName=JP, organizationName=Fuji Xerox, commonName=FUJIFILM Fnet CA - G2
- Issuer: countryName=JP, organizationName=Fuji Xerox, commonName=Fuji Xerox Certification Authority - G2
- Serial: 013FC5401FA04C4341
- SHA-256: A357FDB57488EA37F8F1CD69A016B8677FAD8592632A51ADA942C4715BF17E1E
- SPKI SHA-256: EF3631B49F632F015BD1610E04B000A3EBEEA10309D17A71EF4AE6969F7175F6
- Validity: 2015-08-12 to 2021-03-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.8
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://caps.fujixerox.co.jp/crl/fxca-g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:3f:c5:40:1f:a0:4c:43:41
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = Fuji Xerox, CN = Fuji Xerox Certification Authority - G2
        Validity
            Not Before: Aug 12 15:00:00 2015 GMT
            Not After : Mar 31 11:52:44 2021 GMT
        Subject: C = JP, O = Fuji Xerox, CN = FUJIFILM Fnet CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                74:27:3F:EA:47:F7:D0:39:B7:AD:0A:37:55:E2:D5:DB:CC:A6:71:16
            X509v3 Authority Key Identifier:
                1E:89:C4:2F:A6:2F:3C:EE:A4:7F:F6:B3:BE:40:C1:23:5B:E0:D5:36
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.297.1.5.1.8
                  CPS: http://www.fujixerox.co.jp/product/cap/fxca-g2.html
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://caps.fujixerox.co.jp/crl/fxca-g2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A357FDB57488EA37F8F1CD69A016B8677FAD8592632A51ADA942C4715BF17E1E
    SPKI SHA256: EF3631B49F632F015BD1610E04B000A3EBEEA10309D17A71EF4AE6969F7175F6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.297.1.5.1.8
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://caps.fujixerox.co.jp/crl/fxca-g2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_key_usage_not_critical: 
- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_ext_key_usage_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### FUJIFILM Fnet CA - S

- Subject: countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - S
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0E529F4E49ECE
- SHA-256: 2F1E23908D4B35FB25202A3640BA57054BEADE67B1B6070FF896FE010F54613B
- SPKI SHA-256: 1E49513476EA89CCEDCBE9AEFFBF84B2C958CAA255E5E2F51179C3D75C6B932D
- Validity: 2015-09-18 to 2025-09-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:e5:29:f4:e4:9e:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep 18 04:51:07 2015 GMT
            Not After : Sep 18 04:51:07 2025 GMT
        Subject: C = JP, O = FUJIFILM, CN = FUJIFILM Fnet CA - S
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AD:D0:89:0F:2A:16:3B:36:D1:04:7E:8F:BA:D5:7C:30:97:0B:17:4A
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2F1E23908D4B35FB25202A3640BA57054BEADE67B1B6070FF896FE010F54613B
    SPKI SHA256: 1E49513476EA89CCEDCBE9AEFFBF84B2C958CAA255E5E2F51179C3D75C6B932D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### FUJIFILM Fnet CA - S2

- Subject: countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - S2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B13CED40468405
- SHA-256: EDD4FBA40CD3ABAE14F175BBDF6706A6B728007A6B46D866CA07B76743AFF42C
- SPKI SHA-256: 16866B391B5F39055021D9DA3BEA69871642FCC350435598A1B47DF3525AC9D9
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/fnetcas2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:3c:ed:40:46:84:05
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 18 06:44:14 2018 GMT
            Not After : Apr 18 06:44:14 2028 GMT
        Subject: C = JP, O = FUJIFILM, CN = FUJIFILM Fnet CA - S2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9D:E3:69:26:8E:B2:3C:72:84:7C:23:A4:8D:3A:68:5E:76:A1:3A:D0
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EDD4FBA40CD3ABAE14F175BBDF6706A6B728007A6B46D866CA07B76743AFF42C
    SPKI SHA256: 16866B391B5F39055021D9DA3BEA69871642FCC350435598A1B47DF3525AC9D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### FUJIFILM Fnet CA - S2

- Subject: countryName=JP, organizationName=FUJIFILM, commonName=FUJIFILM Fnet CA - S2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18434296A76FEA859C61B8F8EAF
- SHA-256: F0AFAE187046A431EDDCEFF19CE5AE306D52338F88A11EC11B95B81D521895A4
- SPKI SHA-256: 16866B391B5F39055021D9DA3BEA69871642FCC350435598A1B47DF3525AC9D9
- Validity: 2020-12-15 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://repo1.secomtrust.net/sppca/xerox/fnetcas2/CP.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/fnetcas2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:84:34:29:6a:76:fe:a8:59:c6:1b:8f:8e:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 15 08:25:17 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = FUJIFILM, CN = FUJIFILM Fnet CA - S2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9D:E3:69:26:8E:B2:3C:72:84:7C:23:A4:8D:3A:68:5E:76:A1:3A:D0
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:fujifilm.co.jp
                  DNS:fujifilm.com
                  DNS:skydesk.jp
                  DNS:fujifilm-intra.com
                  DirName:C = JP, ST = Tokyo, L = Minato-ku, O = FUJIFILM
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F0AFAE187046A431EDDCEFF19CE5AE306D52338F88A11EC11B95B81D521895A4
    SPKI SHA256: 16866B391B5F39055021D9DA3BEA69871642FCC350435598A1B47DF3525AC9D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### FujiSSL Public Certification Authority - G1

- Subject: countryName=JP, organizationName=Nijimo, Inc., commonName=FujiSSL Public Certification Authority - G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0FCD4C7943B40
- SHA-256: 7CF75F006CCFF8DA30D6EA2A2F7C50D0447AA2513FF4A4A37BF292470BBA8C85
- SPKI SHA-256: 42B3F066C12055555B9D0C048A42674139C088ED17BEA34E8BD80A423ED7B784
- Validity: 2016-08-16 to 2026-08-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:fc:d4:c7:94:3b:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 16 05:13:31 2016 GMT
            Not After : Aug 16 05:13:31 2026 GMT
        Subject: C = JP, O = "Nijimo, Inc.", CN = FujiSSL Public Certification Authority - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                82:2E:30:32:24:87:93:5F:02:21:56:07:D7:47:40:9B:06:9F:FB:5A
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7CF75F006CCFF8DA30D6EA2A2F7C50D0447AA2513FF4A4A37BF292470BBA8C85
    SPKI SHA256: 42B3F066C12055555B9D0C048A42674139C088ED17BEA34E8BD80A423ED7B784
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### FujiSSL Public Certification Authority - G2

- Subject: countryName=JP, organizationName=Nijimo, Inc., commonName=FujiSSL Public Certification Authority - G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B13D9238E0BBC2
- SHA-256: A17D610D684A4FF22892EB3C0325BC6F7EAEC78714B876721ECBB03335761726
- SPKI SHA-256: F491D535505F1C998F6159763189C7A559E0534EFCFF0DB9543D917E104FFB19
- Validity: 2018-04-18 to 2028-04-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:3d:92:38:e0:bb:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 18 06:53:32 2018 GMT
            Not After : Apr 18 06:53:32 2028 GMT
        Subject: C = JP, O = "Nijimo, Inc.", CN = FujiSSL Public Certification Authority - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                3A:D8:5F:BE:A9:00:13:54:3D:24:F4:82:34:5D:F7:02:2E:F6:DA:53
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A17D610D684A4FF22892EB3C0325BC6F7EAEC78714B876721ECBB03335761726
    SPKI SHA256: F491D535505F1C998F6159763189C7A559E0534EFCFF0DB9543D917E104FFB19
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### FujiSSL Public Validation Authority - G3

- Subject: countryName=JP, organizationName=Nijimo, Inc., commonName=FujiSSL Public Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B14CD1831A062D
- SHA-256: FA2F2F420EEBB2F786CDC7A58B3E4854BBBCC66987FBFD9B598E436578960888
- SPKI SHA-256: FA0F95523B4F1BF0B70648EB11D21EF9C63C2FC3631B780197A45DB3FBF162DF
- Validity: 2018-07-31 to 2028-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:4c:d1:83:1a:06:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 05:36:09 2018 GMT
            Not After : Jul 31 05:36:09 2028 GMT
        Subject: C = JP, O = "Nijimo, Inc.", CN = FujiSSL Public Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F5:80:A6:B5:9C:48:90:57:DD:CD:2E:FA:67:12:6B:DE:50:3C:CF:3D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FA2F2F420EEBB2F786CDC7A58B3E4854BBBCC66987FBFD9B598E436578960888
    SPKI SHA256: FA0F95523B4F1BF0B70648EB11D21EF9C63C2FC3631B780197A45DB3FBF162DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### FujiSSL Public Validation Authority - G3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=FujiSSL Public Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B154F33C5E5E00
- SHA-256: 56DA6EFEF1D504134C72EEDC3AE44AA7FA11B848820DBFAA86CA8E35D60EDB04
- SPKI SHA-256: 7738EADB08A595D5A801EF4CD65CF802E2C69A6158831003DB36085CC85BCE3A
- Validity: 2018-08-22 to 2028-08-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nijimo3/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:54:f3:3c:5e:5e:00
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 22 07:41:02 2018 GMT
            Not After : Aug 22 07:41:02 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = FujiSSL Public Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BC:EB:D9:11:E0:51:64:6F:FF:F0:74:4F:0D:5A:AB:4A:4F:2D:78:27
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 56DA6EFEF1D504134C72EEDC3AE44AA7FA11B848820DBFAA86CA8E35D60EDB04
    SPKI SHA256: 7738EADB08A595D5A801EF4CD65CF802E2C69A6158831003DB36085CC85BCE3A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### JPRS Domain Validation Authority - G1

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0F71D5DAC6E8C
- SHA-256: 27E093E883607E4E0E0BB1EBABAE2C9C0E55A9CF020373BFA234FE05FE0BA743
- SPKI SHA-256: 584F30B90A4CF0EC2A2D6FC7DDE8E567F54C3DC24C613380FE082B1966D2A4D7
- Validity: 2016-04-06 to 2026-04-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:f7:1d:5d:ac:6e:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr  6 05:43:13 2016 GMT
            Not After : Apr  6 05:43:13 2026 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Domain Validation Authority - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                4B:74:3D:00:CB:EF:F6:57:5C:B6:B6:F1:5A:91:22:7B:A4:C9:87:B3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 27E093E883607E4E0E0BB1EBABAE2C9C0E55A9CF020373BFA234FE05FE0BA743
    SPKI SHA256: 584F30B90A4CF0EC2A2D6FC7DDE8E567F54C3DC24C613380FE082B1966D2A4D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### JPRS Domain Validation Authority - G2

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B12E04A7EC2BEC
- SHA-256: C3F908A79CDD80C13025CB5323B111AC79099EB80122F999DBB22F1AA1662DDC
- SPKI SHA-256: A7BAD673DDF2F731541373F7FBA2182B0B674751AFB726CEA133C65DD48C37A0
- Validity: 2018-03-09 to 2028-03-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:2e:04:a7:ec:2b:ec
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar  9 05:54:22 2018 GMT
            Not After : Mar  9 05:54:22 2028 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Domain Validation Authority - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BB:3A:EA:57:62:78:0C:32:AD:1F:B2:7B:F6:1D:06:22:96:E1:AB:F0
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C3F908A79CDD80C13025CB5323B111AC79099EB80122F999DBB22F1AA1662DDC
    SPKI SHA256: A7BAD673DDF2F731541373F7FBA2182B0B674751AFB726CEA133C65DD48C37A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### JPRS Domain Validation Authority - G3

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B15DEFDD158804EB5F278C825020
- SHA-256: 11A27671872265445CB7258EB2844EE614D14777B9F6F73BE9532122F21FAD0D
- SPKI SHA-256: 9F5B9F6FC975FC4356FEE38A34A80721E05EFCD815237F5FD08CF05A60951EF1
- Validity: 2019-07-11 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: JPRS
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CP-en.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CPS-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/dvca_g3/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, OCSP Signing
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:5d:ef:dd:15:88:04:eb:5f:27:8c:82:50:20
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 11 04:45:52 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Domain Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:17:FF:A0:61:BD:50:8C:27:6B:C9:96:C1:4E:18:5E:EF:78:62:D9
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11A27671872265445CB7258EB2844EE614D14777B9F6F73BE9532122F21FAD0D
    SPKI SHA256: 9F5B9F6FC975FC4356FEE38A34A80721E05EFCD815237F5FD08CF05A60951EF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, OCSP Signing
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Domain Validation Authority - G3

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B176817E3637C555F5C42D4C36BF
- SHA-256: 927E9BFC0D75C3146070C3F3AFDD4A2C10F765289124997CC52CFD1209E763CB
- SPKI SHA-256: 9F5B9F6FC975FC4356FEE38A34A80721E05EFCD815237F5FD08CF05A60951EF1
- Validity: 2020-07-10 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: JPRS
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CP-en.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CPS-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:76:81:7e:36:37:c5:55:f5:c4:2d:4c:36:bf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 10 12:58:45 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Domain Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:17:FF:A0:61:BD:50:8C:27:6B:C9:96:C1:4E:18:5E:EF:78:62:D9
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 927E9BFC0D75C3146070C3F3AFDD4A2C10F765289124997CC52CFD1209E763CB
    SPKI SHA256: 9F5B9F6FC975FC4356FEE38A34A80721E05EFCD815237F5FD08CF05A60951EF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Domain Validation Authority - G3

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B174E5DA7D6EEB
- SHA-256: 659B7A518C6C9EB18AA1EB35AEBA7A0247817B898C1FA1840F97D2877D9A20E4
- SPKI SHA-256: 9F5B9F6FC975FC4356FEE38A34A80721E05EFCD815237F5FD08CF05A60951EF1
- Validity: 2020-07-10 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: JPRS
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:74:e5:da:7d:6e:eb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 10 05:09:35 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Domain Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:17:FF:A0:61:BD:50:8C:27:6B:C9:96:C1:4E:18:5E:EF:78:62:D9
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 659B7A518C6C9EB18AA1EB35AEBA7A0247817B898C1FA1840F97D2877D9A20E4
    SPKI SHA256: 9F5B9F6FC975FC4356FEE38A34A80721E05EFCD815237F5FD08CF05A60951EF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Domain Validation Authority - G4

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Domain Validation Authority - G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B17F05E48A55E6F5EF198802FFB9
- SHA-256: F19D55CD08A3EA42BD91508073823174DD92370213C177F82531756DA7508A51
- SPKI SHA-256: 29B1140DA7C33485253B12E2683FBC280971A7E81E6BAE4EE7BAAAE25E52165F
- Validity: 2020-07-22 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Japan Registry Services Co., Ltd.
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/dvca_g4/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:7f:05:e4:8a:55:e6:f5:ef:19:88:02:ff:b9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 22 10:40:53 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Domain Validation Authority - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                7C:24:CE:0D:A4:38:2D:C7:B3:63:5E:A7:78:7A:8D:1D:4C:2E:C7:15
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F19D55CD08A3EA42BD91508073823174DD92370213C177F82531756DA7508A51
    SPKI SHA256: 29B1140DA7C33485253B12E2683FBC280971A7E81E6BAE4EE7BAAAE25E52165F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS DV ECC CA 2024 G1

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS DV ECC CA 2024 G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 1DAFAA4500ACA26353B09C3F0C6B6EBF
- SHA-256: 1B901D550A5A51F6737279C6021445F051BD293015612A5BAA3F8588829EE69A
- SPKI SHA-256: 77B22C5C0D25B0EBFE4A0C5946B0DB33E03F70D42802D0B4899DA4451E7C6F97
- Validity: 2024-04-04 to 2031-06-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Japan Registry Services Co., Ltd.
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/dvca_ecc2024g1/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:af:aa:45:00:ac:a2:63:53:b0:9c:3f:0c:6b:6e:bf
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Apr  4 05:30:34 2024 GMT
            Not After : Jun 16 00:00:00 2031 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS DV ECC CA 2024 G1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Subject Key Identifier:
                58:7C:1D:25:86:48:6A:EC:29:3A:BA:EF:5E:4D:7D:AB:F4:40:50:BF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.2.392.200091.100.902.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1B901D550A5A51F6737279C6021445F051BD293015612A5BAA3F8588829EE69A
    SPKI SHA256: 77B22C5C0D25B0EBFE4A0C5946B0DB33E03F70D42802D0B4899DA4451E7C6F97
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS DV RSA CA 2024 G1

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS DV RSA CA 2024 G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Serial: 47A5911DF50A9BCFBACCC94B6211D57F
- SHA-256: 52361A6ABC835E7AD4B375F2165055303169DDE9FBEB4FAAF588ED532DDC2DCB
- SPKI SHA-256: 92604A2177235C7A1331596414DA8330228FC7FD101A7BA3BCC22563C561BEC3
- Validity: 2024-04-04 to 2039-01-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Japan Registry Services Co., Ltd.
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/dvca_rsa2024g1/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.392.200091.100.901.11
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:a5:91:1d:f5:0a:9b:cf:ba:cc:c9:4b:62:11:d5:7f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Validity
            Not Before: Apr  4 04:50:03 2024 GMT
            Not After : Jan 12 00:00:00 2039 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS DV RSA CA 2024 G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Subject Key Identifier:
                A2:1D:F5:7F:CA:6D:04:91:84:68:6D:B8:17:EA:18:4A:9A:A8:CA:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.2.392.200091.100.901.11
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlsrsarootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 52361A6ABC835E7AD4B375F2165055303169DDE9FBEB4FAAF588ED532DDC2DCB
    SPKI SHA256: 92604A2177235C7A1331596414DA8330228FC7FD101A7BA3BCC22563C561BEC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.392.200091.100.901.11
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Organization Validation Authority - G1

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0F6A6B9E0C3C2
- SHA-256: F77CE159D3888EA2BCC35DD46472CED8CC33007E0DA6C89139CD3A270D890033
- SPKI SHA-256: 2F989E18974F4710BFF7C27EF4F86C3B57FDBB14593B3C2AF1B75F8386A41A69
- Validity: 2016-04-06 to 2026-04-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:f6:a6:b9:e0:c3:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr  6 05:33:46 2016 GMT
            Not After : Apr  6 05:33:46 2026 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Organization Validation Authority - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                65:C5:05:EE:38:C9:FD:64:32:FB:08:17:07:F6:6B:F9:85:8F:99:B0
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F77CE159D3888EA2BCC35DD46472CED8CC33007E0DA6C89139CD3A270D890033
    SPKI SHA256: 2F989E18974F4710BFF7C27EF4F86C3B57FDBB14593B3C2AF1B75F8386A41A69
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### JPRS Organization Validation Authority - G2

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B12D06D4350C34
- SHA-256: DB2F0194EDCB78CBA9D1BAF4C3DBA8D56837D97B20233D617DD50B713BD313C8
- SPKI SHA-256: E78799438AC1DCEF0D728800516D316FE2A3F26525CF5097B106EA02FE49A321
- Validity: 2018-03-09 to 2028-03-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:2d:06:d4:35:0c:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar  9 05:43:03 2018 GMT
            Not After : Mar  9 05:43:03 2028 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Organization Validation Authority - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E2:5D:36:4D:26:BA:EC:17:C6:26:90:F4:C8:B8:FF:37:7D:5A:00:02
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DB2F0194EDCB78CBA9D1BAF4C3DBA8D56837D97B20233D617DD50B713BD313C8
    SPKI SHA256: E78799438AC1DCEF0D728800516D316FE2A3F26525CF5097B106EA02FE49A321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### JPRS Organization Validation Authority - G3

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B175E35A273EBB6F5EEE02AD9DD8
- SHA-256: 04C1871C68607515389FA3B0CFB83DBE6A4AF05E8C80E745702969F240606E36
- SPKI SHA-256: 733495ABB0C583A3210F42ED3F1589D8FC42B167C34BB03E5F339E918B6A11B3
- Validity: 2020-07-10 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: JPRS
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CP-en.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CPS-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:75:e3:5a:27:3e:bb:6f:5e:ee:02:ad:9d:d8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 10 12:47:41 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Organization Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A1:10:15:D8:1B:FE:9E:4E:9A:4E:1D:F2:B6:5F:41:13:82:1D:41:53
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 04C1871C68607515389FA3B0CFB83DBE6A4AF05E8C80E745702969F240606E36
    SPKI SHA256: 733495ABB0C583A3210F42ED3F1589D8FC42B167C34BB03E5F339E918B6A11B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Organization Validation Authority - G3

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B15C4A1261748A504D172147A9CC
- SHA-256: 90EE548EBACACAB40207A61A378CE186B94D24AE7C55BFC83065EA96072E2B38
- SPKI SHA-256: 733495ABB0C583A3210F42ED3F1589D8FC42B167C34BB03E5F339E918B6A11B3
- Validity: 2019-07-11 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: JPRS
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CP-en.pdf, https://jprs.jp/pubcert/info/repository/JPRS-CPS-en.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/ovca_g3/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, OCSP Signing
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:5c:4a:12:61:74:8a:50:4d:17:21:47:a9:cc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 11 04:35:04 2019 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Organization Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A1:10:15:D8:1B:FE:9E:4E:9A:4E:1D:F2:B6:5F:41:13:82:1D:41:53
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 90EE548EBACACAB40207A61A378CE186B94D24AE7C55BFC83065EA96072E2B38
    SPKI SHA256: 733495ABB0C583A3210F42ED3F1589D8FC42B167C34BB03E5F339E918B6A11B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, OCSP Signing
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Organization Validation Authority - G3

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B172FA931A5B74
- SHA-256: 21C066332D6B92DD9A253E2637684A5BC3E31357F863BED7A2F98C8459A33B62
- SPKI SHA-256: 733495ABB0C583A3210F42ED3F1589D8FC42B167C34BB03E5F339E918B6A11B3
- Validity: 2020-07-10 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: JPRS
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=85ed55c3-ae53-4810-82d6-51a8dd966d1d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f174bd9a-ac88-4fc5-b0f4-fba540e84f30
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:72:fa:93:1a:5b:74
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 10 04:48:56 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Organization Validation Authority - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A1:10:15:D8:1B:FE:9E:4E:9A:4E:1D:F2:B6:5F:41:13:82:1D:41:53
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 21C066332D6B92DD9A253E2637684A5BC3E31357F863BED7A2F98C8459A33B62
    SPKI SHA256: 733495ABB0C583A3210F42ED3F1589D8FC42B167C34BB03E5F339E918B6A11B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS Organization Validation Authority - G4

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS Organization Validation Authority - G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B17E7B3B17E9FEE430280C2C2F59
- SHA-256: 801C522D3AD138E4F05D467EA369C1CC276078BF284018D0525EBBBC5342C836
- SPKI SHA-256: C4E4B20026008EC43E6970F688416728254E714B17F00555A8219CCCCA21F25C
- Validity: 2020-07-22 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Japan Registry Services Co., Ltd.
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/ovca_g4/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:7e:7b:3b:17:e9:fe:e4:30:28:0c:2c:2f:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 22 10:23:28 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS Organization Validation Authority - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D5:35:AE:C4:D4:32:6E:80:29:15:2A:D4:00:1C:B4:ED:23:B9:2B:38
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 801C522D3AD138E4F05D467EA369C1CC276078BF284018D0525EBBBC5342C836
    SPKI SHA256: C4E4B20026008EC43E6970F688416728254E714B17F00555A8219CCCCA21F25C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS OV ECC CA 2024 G1

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS OV ECC CA 2024 G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 1DAFAA46F91F30C80CCC1CC1DCFDD294
- SHA-256: 9C280369D072F89D9C9B62640BBF2F28D2F30ECEE9759854031D5C5C53E8D1B6
- SPKI SHA-256: BFF71563B7FA6D7A42876398C0AEB098413D6486AE7D4266A12969C56BE30432
- Validity: 2024-04-04 to 2031-06-16
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Japan Registry Services Co., Ltd.
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/ovca_ecc2024g1/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:af:aa:46:f9:1f:30:c8:0c:cc:1c:c1:dc:fd:d2:94
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Apr  4 05:53:50 2024 GMT
            Not After : Jun 16 00:00:00 2031 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS OV ECC CA 2024 G1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Subject Key Identifier:
                7E:9E:2A:AE:6A:8D:40:0A:7B:B2:11:66:60:55:F1:BF:AF:6C:EC:18
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.902.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9C280369D072F89D9C9B62640BBF2F28D2F30ECEE9759854031D5C5C53E8D1B6
    SPKI SHA256: BFF71563B7FA6D7A42876398C0AEB098413D6486AE7D4266A12969C56BE30432
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JPRS OV RSA CA 2024 G1

- Subject: countryName=JP, organizationName=Japan Registry Services Co., Ltd., commonName=JPRS OV RSA CA 2024 G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Serial: 47A5911EF8E1B63325130A546BDC62E8
- SHA-256: DAFA254E0173F0FD793A92ECFDF2C72C53EA5A761A73B7A3394C49182EA90933
- SPKI SHA-256: F684DB7A8C9CE754F9869118344C620CD8398C48A0D0ED5859144B770487D56C
- Validity: 2024-04-04 to 2039-01-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: Japan Registry Services Co., Ltd.
- CP/CPS: https://jprs.jp/pubcert/info/repository/JPRS-CPCPS-en.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=766b137c-0a99-4921-96da-5ac6b23148c9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=3b8f90a4-02d7-463d-b007-f10b1cd7eca3, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5aa914e7-91db-43ec-baef-ce61c39850df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo.pubcert.jprs.jp/sppca/jprs/ovca_rsa2024g1/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.11
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:a5:91:1e:f8:e1:b6:33:25:13:0a:54:6b:dc:62:e8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Validity
            Not Before: Apr  4 05:05:41 2024 GMT
            Not After : Jan 12 00:00:00 2039 GMT
        Subject: C = JP, O = "Japan Registry Services Co., Ltd.", CN = JPRS OV RSA CA 2024 G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Subject Key Identifier:
                F5:B6:55:E3:DB:DC:66:D6:A0:31:C1:70:DD:22:C7:D1:BD:CA:F2:5D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.901.11
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlsrsarootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DAFA254E0173F0FD793A92ECFDF2C72C53EA5A761A73B7A3394C49182EA90933
    SPKI SHA256: F684DB7A8C9CE754F9869118344C620CD8398C48A0D0ED5859144B770487D56C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.11
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KAGOYA JAPAN Certification Authority

- Subject: countryName=JP, organizationName=KAGOYA JAPAN Inc., commonName=KAGOYA JAPAN Certification Authority
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0EA
- SHA-256: 2BF21B41EE4B836CA55E6F2472B87D0CA3CF4B3FE0A51B6FAF3C2F2D9C74EAD8
- SPKI SHA-256: C2C8E207B17DAF807A3C9ACE03FFE20EDA9E16D793D352C388449EA129B46992
- Validity: 2012-12-20 to 2022-12-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159338 (0x12b9b0ea)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Dec 20 06:25:07 2012 GMT
            Not After : Dec 20 06:25:07 2022 GMT
        Subject: C = JP, O = KAGOYA JAPAN Inc., CN = KAGOYA JAPAN Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D8:77:D6:6D:51:49:07:83:60:07:B9:45:15:7F:61:C1:8A:1F:F2:5E
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2BF21B41EE4B836CA55E6F2472B87D0CA3CF4B3FE0A51B6FAF3C2F2D9C74EAD8
    SPKI SHA256: C2C8E207B17DAF807A3C9ACE03FFE20EDA9E16D793D352C388449EA129B46992
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### KDDI Web Communications Certification Authority

- Subject: countryName=JP, organizationName=KDDI Web Communications Inc., commonName=KDDI Web Communications Certification Authority
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0D8
- SHA-256: 655010377E23E4CDFE2E52CAF58CE30C5C0395CC6046F813BDDBE07B2F385448
- SPKI SHA-256: D931106262F51DE2AB8913A5444CEDFBA33C9555BC6AFBFD373B6E40E8881C97
- Validity: 2015-03-26 to 2025-03-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594776 (0x22b9b0d8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 26 06:45:34 2015 GMT
            Not After : Mar 26 06:45:34 2025 GMT
        Subject: C = JP, O = KDDI Web Communications Inc., CN = KDDI Web Communications Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                6D:9D:1F:00:11:1A:4D:00:AA:B4:4A:44:60:22:CA:EE:F2:5D:EB:F2
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 655010377E23E4CDFE2E52CAF58CE30C5C0395CC6046F813BDDBE07B2F385448
    SPKI SHA256: D931106262F51DE2AB8913A5444CEDFBA33C9555BC6AFBFD373B6E40E8881C97
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### KDDI Web Communications Certification Authority 2

- Subject: countryName=JP, organizationName=KDDI Web Communications Inc., commonName=KDDI Web Communications Certification Authority 2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B13684A2A4AA92
- SHA-256: 6AC664092D9BB156A11026E4FE734D3378C80DED451986B0BA5ECA11C6DF8ABB
- SPKI SHA-256: 69435500C28586DCDA55285451C05BA7CC4FFE9967BAA6819FCD13A472957CDB
- Validity: 2018-04-10 to 2028-04-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:36:84:a2:a4:aa:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 10 01:03:15 2018 GMT
            Not After : Apr 10 01:03:15 2028 GMT
        Subject: C = JP, O = KDDI Web Communications Inc., CN = KDDI Web Communications Certification Authority 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                09:91:88:DB:80:BA:6B:CB:86:AA:3D:9D:EC:47:EE:1C:3C:33:96:78
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6AC664092D9BB156A11026E4FE734D3378C80DED451986B0BA5ECA11C6DF8ABB
    SPKI SHA256: 69435500C28586DCDA55285451C05BA7CC4FFE9967BAA6819FCD13A472957CDB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### KDDI Web Communications Certification Authority 3

- Subject: countryName=JP, organizationName=KDDI Web Communications Inc., commonName=KDDI Web Communications Certification Authority 3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1483713B993B6
- SHA-256: 623A9F2163E33585905B6F65A4997596FC785FA54437A41D22794A5F47813A29
- SPKI SHA-256: 7B085910ACDAADF95F75CB04ED3F0A77DB39336F0C727D408A92B87FEC434CDF
- Validity: 2018-07-31 to 2028-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:48:37:13:b9:93:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 04:57:17 2018 GMT
            Not After : Jul 31 04:57:17 2028 GMT
        Subject: C = JP, O = KDDI Web Communications Inc., CN = KDDI Web Communications Certification Authority 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                98:19:22:DD:22:44:9F:0B:5F:61:06:40:D2:8C:56:2C:3B:74:95:38
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 623A9F2163E33585905B6F65A4997596FC785FA54437A41D22794A5F47813A29
    SPKI SHA256: 7B085910ACDAADF95F75CB04ED3F0A77DB39336F0C727D408A92B87FEC434CDF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### KDDI Web Communications Certification Authority 3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=KDDI Web Communications Certification Authority 3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B150F277A586AD
- SHA-256: 2B30D5E912906358C9AD6FB57FD7B368A01A78E395B4EC11645C5B98A0967DE8
- SPKI SHA-256: 8C858B5F630360B3F5DA9F78EC5506C7074947C018F323DC62FFD3A5650D0D04
- Validity: 2018-08-22 to 2028-08-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6494439-6e3d-4419-8084-9f2fe1cfc2b2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b1800b13-762b-4477-94d2-da5523f81477
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/xerox/fnetcas2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:50:f2:77:a5:86:ad
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 22 07:05:32 2018 GMT
            Not After : Aug 22 07:05:32 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = KDDI Web Communications Certification Authority 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D5:85:07:1E:68:1B:A7:2F:8F:D5:CA:92:60:52:D1:71:08:5D:70:B0
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2B30D5E912906358C9AD6FB57FD7B368A01A78E395B4EC11645C5B98A0967DE8
    SPKI SHA256: 8C858B5F630360B3F5DA9F78EC5506C7074947C018F323DC62FFD3A5650D0D04
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### LGPKI AATL RSA CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=LGPKI AATL RSA CA 2024, organizationIdentifier=NTRJP-4011001040781
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Document Signing RSA Root CA 2023, organizationIdentifier=NTRJP-4011001040781
- Serial: 3FF11F906E2AE65BA051C6925E9B0676
- SHA-256: 2BC9BA5FEB6A04A31D804ACABD6000D6B4B5FCCB97CCE54D2D4A35117B30986B
- SPKI SHA-256: D2061A285C1F1AFDB39EFF55F30EDBB8E61A5AFE12FA4763C13EB04F24679FA3
- Validity: 2024-08-08 to 2044-07-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/lgpki/lgpkiaatlrsaca2024/lgpkiaatlrsaca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://docrsarootca2023.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:f1:1f:90:6e:2a:e6:5b:a0:51:c6:92:5e:9b:06:76
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Document Signing RSA Root CA 2023, organizationIdentifier = NTRJP-4011001040781
        Validity
            Not Before: Aug  8 05:53:29 2024 GMT
            Not After : Jul  7 00:00:00 2044 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = LGPKI AATL RSA CA 2024, organizationIdentifier = NTRJP-4011001040781
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                53:92:94:7C:D4:46:F6:3F:E7:6F:46:4E:F9:1E:35:4C:B7:34:41:27
            X509v3 Authority Key Identifier:
                01:DD:B1:24:30:89:2C:C8:03:83:5E:10:AE:71:1E:49:F2:EE:4B:07
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.10
                  CPS: http://repo1.secomtrust.net/root/docrsa/
            Authority Information Access:
                OCSP - URI:http://docrsarootca2023.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/docrsa/docrsarootca2023.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2BC9BA5FEB6A04A31D804ACABD6000D6B4B5FCCB97CCE54D2D4A35117B30986B
    SPKI SHA256: D2061A285C1F1AFDB39EFF55F30EDBB8E61A5AFE12FA4763C13EB04F24679FA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.10
- AIA OCSP: http://docrsarootca2023.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/docrsa/docrsarootca2023.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G3

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G3
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0F7
- SHA-256: 67DACBA288D752C8569439C8E22F6A1EB71F10D636F4BEB140ABC26BBB70D49B
- SPKI SHA-256: F536D6CAA66625A0097EEFBB4B6B7243AACDA685AF33E04099C6F5FD57874532
- Validity: 2014-12-25 to 2018-12-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159351 (0x12b9b0f7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Dec 25 04:51:53 2014 GMT
            Not After : Dec 25 04:51:53 2018 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                34:33:56:73:D9:AD:BD:48:C4:5E:77:5A:E0:50:E7:D7:2F:EA:4A:FA
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 67DACBA288D752C8569439C8E22F6A1EB71F10D636F4BEB140ABC26BBB70D49B
    SPKI SHA256: F536D6CAA66625A0097EEFBB4B6B7243AACDA685AF33E04099C6F5FD57874532
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### NII Open Domain CA - G4

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0CC
- SHA-256: 6540CFCF743E84AB2D67866F2F13A53FE7AF2E8977A5C1681FE07A1869620DD1
- SPKI SHA-256: A6460ECA265BABA7A21B7F9F4C77503CA9E9C813121CB4DD37CEC1B4AA1B7B6A
- Validity: 2014-12-25 to 2024-12-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594764 (0x22b9b0cc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 25 05:29:42 2014 GMT
            Not After : Dec 25 05:29:42 2024 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain CA - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                19:0B:6F:39:1F:31:03:34:5F:E4:D2:40:1F:37:E6:8D:E7:62:39:7C
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6540CFCF743E84AB2D67866F2F13A53FE7AF2E8977A5C1681FE07A1869620DD1
    SPKI SHA256: A6460ECA265BABA7A21B7F9F4C77503CA9E9C813121CB4DD37CEC1B4AA1B7B6A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### NII Open Domain CA - G4

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18BB69120240411B808BF2DE61A
- SHA-256: 86EBAE8C2902CF12228488728296FDC55F416BB1456F9462DFAC388AE7C9ABE2
- SPKI SHA-256: A6460ECA265BABA7A21B7F9F4C77503CA9E9C813121CB4DD37CEC1B4AA1B7B6A
- Validity: 2021-07-12 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/sppca/nii/odca3/NIIODCA3.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca3/fullcrlg4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:8b:b6:91:20:24:04:11:b8:08:bf:2d:e6:1a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 12 06:15:31 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain CA - G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                19:0B:6F:39:1F:31:03:34:5F:E4:D2:40:1F:37:E6:8D:E7:62:39:7C
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 86EBAE8C2902CF12228488728296FDC55F416BB1456F9462DFAC388AE7C9ABE2
    SPKI SHA256: A6460ECA265BABA7A21B7F9F4C77503CA9E9C813121CB4DD37CEC1B4AA1B7B6A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### NII Open Domain CA - G5

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B16EB150AD7E36
- SHA-256: DACAA09FFAD8F66EDB6ED69707A827C9E44C1F97C48F0179485F206D707B3E2B
- SPKI SHA-256: 6A3FB899BA8E398EDC82D0EA5AD80668B1BAF444A1979F40428715FBE849024F
- Validity: 2020-05-20 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:6e:b1:50:ad:7e:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: May 20 07:37:07 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                67:3A:3A:C1:6B:B7:1C:A6:41:46:39:30:84:C8:69:00:59:11:58:C1
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Name Constraints:
                Permitted:
                  DNS:agu.ac.jp
                  DNS:aichi-edu.ac.jp
                  DNS:aichi-fam-u.ac.jp
                  DNS:aichi-med-u.ac.jp
                  DNS:aichi-pu.ac.jp
                  DNS:aichi-toho.ac.jp
                  DNS:aichi-u.ac.jp
                  DNS:aitech.ac.jp
                  DNS:akashi.ac.jp
                  DNS:akita-nct.ac.jp
                  DNS:akita-u.ac.jp
                  DNS:anan-nct.ac.jp
                  DNS:andrew.ac.jp
                  DNS:apu.ac.jp
                  DNS:ariake-nct.ac.jp
                  DNS:asahikawa-med.ac.jp
                  DNS:asahikawa-nct.ac.jp
                  DNS:asahi-u.ac.jp
                  DNS:bukkyo-u.ac.jp
                  DNS:bunkyo.ac.jp
                  DNS:bunri-u.ac.jp
                  DNS:chibakoudai.jp
                  DNS:chikyu.ac.jp
                  DNS:chubu.ac.jp
                  DNS:chukyo-u.ac.jp
                  DNS:chuo-u.ac.jp
                  DNS:consortium.or.jp
                  DNS:daido-it.ac.jp
                  DNS:daito.ac.jp
                  DNS:dendai.ac.jp
                  DNS:development-school.jp
                  DNS:dohto.ac.jp
                  DNS:dokkyomed.ac.jp
                  DNS:doshisha.ac.jp
                  DNS:eduroam.jp
                  DNS:ehime-u.ac.jp
                  DNS:enri.go.jp
                  DNS:fcu.ac.jp
                  DNS:fdcnet.ac.jp
                  DNS:ferris.ac.jp
                  DNS:ferris.jp
                  DNS:fit.ac.jp
                  DNS:fmu.ac.jp
                  DNS:fpu.ac.jp
                  DNS:fujita-hu.ac.jp
                  DNS:fukui-nct.ac.jp
                  DNS:fukujo.ac.jp
                  DNS:fukuoka-edu.ac.jp
                  DNS:fukuoka-int-u.ac.jp
                  DNS:fukuoka-u.ac.jp
                  DNS:fukushima-nct.ac.jp
                  DNS:fukushima-u.ac.jp
                  DNS:fukuyama-u.ac.jp
                  DNS:fun.ac.jp
                  DNS:gakunin.jp
                  DNS:gifu-cn.ac.jp
                  DNS:gifu-keizai.ac.jp
                  DNS:gifu-nct.ac.jp
                  DNS:gifu-pu.ac.jp
                  DNS:gifu-u.ac.jp
                  DNS:gku.ac.jp
                  DNS:grips.ac.jp
                  DNS:gunma-ct.ac.jp
                  DNS:gunma-u.ac.jp
                  DNS:hachinohe-ct.ac.jp
                  DNS:hachinohe-u.ac.jp
                  DNS:hakodate-ct.ac.jp
                  DNS:hama-med.ac.jp
                  DNS:heisei-iryou.ac.jp
                  DNS:heisei-u.ac.jp
                  DNS:hgu.jp
                  DNS:hirodai.jp
                  DNS:hirokoudai.jp
                  DNS:hirosaki-u.ac.jp
                  DNS:hiroshima-cmt.ac.jp
                  DNS:hiroshima-cu.ac.jp
                  DNS:hiroshima-u.ac.jp
                  DNS:hiroshima-u.jp
                  DNS:hi-tech.ac.jp
                  DNS:hit-u.ac.jp
                  DNS:hmjc.ac.jp
                  DNS:hokkai-s-u.ac.jp
                  DNS:hokkyodai.ac.jp
                  DNS:hokudai.ac.jp
                  DNS:hoku-iryo-u.ac.jp
                  DNS:hokuriku-u.ac.jp
                  DNS:hyogo-u.ac.jp
                  DNS:iamas.ac.jp
                  DNS:iamas.jp
                  DNS:ibaraki.ac.jp
                  DNS:ibaraki-ct.ac.jp
                  DNS:icc.ac.jp
                  DNS:ichinoseki.ac.jp
                  DNS:icu.ac.jp
                  DNS:igakuken.or.jp
                  DNS:ims.ac.jp
                  DNS:internet.ac.jp
                  DNS:iot.ac.jp
                  DNS:ipmu.jp
                  DNS:iri-tokyo.jp
                  DNS:iroop.jp
                  DNS:ishikawa-nct.ac.jp
                  DNS:ism.ac.jp
                  DNS:it-chiba.ac.jp
                  DNS:it-hiroshima.ac.jp
                  DNS:iwakimu.ac.jp
                  DNS:iwate-med.ac.jp
                  DNS:iwate-u.ac.jp
                  DNS:jaist.ac.jp
                  DNS:jamstec.go.jp
                  DNS:jaxa.jp
                  DNS:j-focus.jp
                  DNS:jichi.ac.jp
                  DNS:jin-ai.ac.jp
                  DNS:jindai.ac.jp
                  DNS:josho.ac.jp
                  DNS:j-parc.jp
                  DNS:jrchcn.ac.jp
                  DNS:jsps.go.jp
                  DNS:juen.ac.jp
                  DNS:kacho-college.ac.jp
                  DNS:kaetsu.ac.jp
                  DNS:kagawa-nct.ac.jp
                  DNS:kagawa-u.ac.jp
                  DNS:kagoshima-ct.ac.jp
                  DNS:kagoshima-u.ac.jp
                  DNS:kaiyodai.ac.jp
                  DNS:kanagawa-it.ac.jp
                  DNS:kanazawa-gu.ac.jp
                  DNS:kanazawa-u.ac.jp
                  DNS:kandai.jp
                  DNS:kansai-u.ac.jp
                  DNS:kasei-gakuin.ac.jp
                  DNS:kbu.ac.jp
                  DNS:kct.ac.jp
                  DNS:kcua.ac.jp
                  DNS:keio.ac.jp
                  DNS:keio.jp
                  DNS:kek.jp
                  DNS:kindai.ac.jp
                  DNS:kinjo-gakuin.jp
                  DNS:kinjo-u.ac.jp
                  DNS:kiryu-u.ac.jp
                  DNS:kisarazu.ac.jp
                  DNS:kit.ac.jp
                  DNS:kit.jp
                  DNS:kitakyu-u.ac.jp
                  DNS:kitami-it.ac.jp
                  DNS:k-junshin.ac.jp
                  DNS:kobe-c.ac.jp
                  DNS:kobe-college.jp
                  DNS:kobe-cufs.ac.jp
                  DNS:kobe-kosen.ac.jp
                  DNS:kobe-tokiwa.ac.jp
                  DNS:kobe-u.ac.jp
                  DNS:kochi-ct.ac.jp
                  DNS:kochi-ct.jp
                  DNS:kochi-ms.ac.jp
                  DNS:kochi-tech.ac.jp
                  DNS:kochi-u.ac.jp
                  DNS:kochi-u.jp
                  DNS:kogakuin.ac.jp
                  DNS:kokugakuin.ac.jp
                  DNS:kokushikan.ac.jp
                  DNS:kosen-ac.jp
                  DNS:kosen-k.go.jp
                  DNS:kppuc.ac.jp
                  DNS:kpu.ac.jp
                  DNS:kpu-m.ac.jp
                  DNS:kuas.ac.jp
                  DNS:kufs.ac.jp
                  DNS:kuins.net
                  DNS:kumagaku.ac.jp
                  DNS:kumamoto-hsu.ac.jp
                  DNS:kumamoto-nct.ac.jp
                  DNS:kumamoto-u.ac.jp
                  DNS:kunitachi.ac.jp
                  DNS:kure-nct.ac.jp
                  DNS:kurume-it.ac.jp
                  DNS:kurume-nct.ac.jp
                  DNS:kurume-shinai.ac.jp
                  DNS:kurume-u.ac.jp
                  DNS:kushiro-ct.ac.jp
                  DNS:kwuc.ac.jp
                  DNS:kyohaku.go.jp
                  DNS:kyokyo-u.ac.jp
                  DNS:kyoto-art.ac.jp
                  DNS:kyoto-econ.ac.jp
                  DNS:kyotogakuen-u.ac.jp
                  DNS:kyotokacho-u.ac.jp
                  DNS:kyoto-su.ac.jp
                  DNS:kyoto-u.ac.jp
                  DNS:kyoto-u.jp
                  DNS:kyoto-wu.ac.jp
                  DNS:kyu-dent.ac.jp
                  DNS:kyukyo-u.ac.jp
                  DNS:kyusan-u.ac.jp
                  DNS:kyushu-u.ac.jp
                  DNS:kyutech.ac.jp
                  DNS:kyutech.jp
                  DNS:maizuru-ct.ac.jp
                  DNS:matsue-ct.ac.jp
                  DNS:matsue-ct.jp
                  DNS:matsuyama-u.ac.jp
                  DNS:matsuyama-u.jp
                  DNS:meiji-u.ac.jp
                  DNS:meio-u.ac.jp
                  DNS:meirin-c.ac.jp
                  DNS:mejiro.ac.jp
                  DNS:metro-cit.ac.jp
                  DNS:mie-u.ac.jp
                  DNS:minpaku.ac.jp
                  DNS:miyakonojo-nct.ac.jp
                  DNS:miyakyo-u.ac.jp
                  DNS:miyasankei-u.ac.jp
                  DNS:miyazaki-mu.ac.jp
                  DNS:miyazaki-u.ac.jp
                  DNS:mpu.ac.jp
                  DNS:muroran-it.ac.jp
                  DNS:musabi.ac.jp
                  DNS:myjuen.jp
                  DNS:my-pharm.ac.jp
                  DNS:myu.ac.jp
                  DNS:nabunken.go.jp
                  DNS:nagano.ac.jp
                  DNS:nagano-nct.ac.jp
                  DNS:nagaoka-ct.ac.jp
                  DNS:nagaokaut.ac.jp
                  DNS:nagasaki-u.ac.jp
                  DNS:nagoya-bunri.ac.jp
                  DNS:nagoya-cu.ac.jp
                  DNS:nagoya-u.ac.jp
                  DNS:nagoya-u.jp
                  DNS:nagoya-wu.ac.jp
                  DNS:naist.jp
                  DNS:nakanishi.ac.jp
                  DNS:nanzan.jp
                  DNS:nanzan-u.ac.jp
                  DNS:nao.ac.jp
                  DNS:nara-edu.ac.jp
                  DNS:narahaku.go.jp
                  DNS:nara-k.ac.jp
                  DNS:naramed-u.ac.jp
                  DNS:nara-wu.ac.jp
                  DNS:naregi.org
                  DNS:naruto-u.ac.jp
                  DNS:ncgg.go.jp
                  DNS:ncgm.go.jp
                  DNS:ncnp.go.jp
                  DNS:nc-toyama.ac.jp
                  DNS:netnfu.ne.jp
                  DNS:neuroinf.jp
                  DNS:nfu.jp
                  DNS:nfu.ne.jp
                  DNS:n-fukushi.ac.jp
                  DNS:nias.ac.jp
                  DNS:nibb.ac.jp
                  DNS:nich.go.jp
                  DNS:nichibun.ac.jp
                  DNS:nifs.ac.jp
                  DNS:nifs-k.ac.jp
                  DNS:nig.ac.jp
                  DNS:nih.go.jp
                  DNS:nihon-u.ac.jp
                  DNS:nihu.jp
                  DNS:nii.ac.jp
                  DNS:niid.go.jp
                  DNS:niigata-u.ac.jp
                  DNS:niihama-nct.ac.jp
                  DNS:nims.go.jp
                  DNS:ninjal.ac.jp
                  DNS:nins.jp
                  DNS:niph.go.jp
                  DNS:nipr.ac.jp
                  DNS:nips.ac.jp
                  DNS:nishogakusha-u.ac.jp
                  DNS:nitech.ac.jp
                  DNS:nitech.jp
                  DNS:nittai.ac.jp
                  DNS:niye.go.jp
                  DNS:nodai.ac.jp
                  DNS:n-seiryo.ac.jp
                  DNS:nua.ac.jp
                  DNS:nuas.ac.jp
                  DNS:nucba.ac.jp
                  DNS:nufs.ac.jp
                  DNS:nuhw.ac.jp
                  DNS:nuis.ac.jp
                  DNS:numazu-ct.ac.jp
                  DNS:nwec.jp
                  DNS:obihiro.ac.jp
                  DNS:obirin.ac.jp
                  DNS:ocha.ac.jp
                  DNS:oist.jp
                  DNS:oit.ac.jp
                  DNS:oita-ct.ac.jp
                  DNS:oita-u.ac.jp
                  DNS:okadai.jp
                  DNS:oka-pu.ac.jp
                  DNS:okayama-u.ac.jp
                  DNS:okinawa-ct.ac.jp
                  DNS:okinawa-u.ac.jp
                  DNS:okiu.ac.jp
                  DNS:onomichi-u.ac.jp
                  DNS:open.ed.jp
                  DNS:osakac.ac.jp
                  DNS:osaka-cu.ac.jp
                  DNS:osakafu-u.ac.jp
                  DNS:osaka-kyoiku.ac.jp
                  DNS:osaka-pct.ac.jp
                  DNS:osaka-u.ac.jp
                  DNS:oshima-k.ac.jp
                  DNS:otani.ac.jp
                  DNS:otaru-uc.ac.jp
                  DNS:otemon.ac.jp
                  DNS:ouhs.ac.jp
                  DNS:ous.ac.jp
                  DNS:oyama-ct.ac.jp
                  DNS:pdbj.org
                  DNS:pu-hiroshima.ac.jp
                  DNS:pu-kumamoto.ac.jp
                  DNS:qst.go.jp
                  DNS:rakuno.ac.jp
                  DNS:rehab.go.jp
                  DNS:reitaku-u.ac.jp
                  DNS:rekihaku.ac.jp
                  DNS:riken.go.jp
                  DNS:riken.jp
                  DNS:rikkyo.ac.jp
                  DNS:rikkyo.ne.jp
                  DNS:ritsumei.ac.jp
                  DNS:rku.ac.jp
                  DNS:rois.ac.jp
                  DNS:ruconsortium.jp
                  DNS:ryukoku.ac.jp
                  DNS:saga-u.ac.jp
                  DNS:saitama-u.ac.jp
                  DNS:sanno.ac.jp
                  DNS:sapmed.ac.jp
                  DNS:sapporo-u.ac.jp
                  DNS:sasebo.ac.jp
                  DNS:scu.ac.jp
                  DNS:seijo.ac.jp
                  DNS:seijoh-u.ac.jp
                  DNS:seikei.ac.jp
                  DNS:seinan-gakuin.jp
                  DNS:seinan-gu.ac.jp
                  DNS:seirei.ac.jp
                  DNS:seisadohto.ac.jp
                  DNS:seisen.ac.jp
                  DNS:seisen-u.ac.jp
                  DNS:sendai-nct.ac.jp
                  DNS:senshu-u.ac.jp
                  DNS:senshu-u.jp
                  DNS:setsunan.ac.jp
                  DNS:sgk.ac.jp
                  DNS:sgu.ac.jp
                  DNS:shibaura-it.ac.jp
                  DNS:shigakkan.jp
                  DNS:shiga-med.ac.jp
                  DNS:shiga-u.ac.jp
                  DNS:shimane-u.ac.jp
                  DNS:shimonoseki-cu.ac.jp
                  DNS:shinonome.ac.jp
                  DNS:shinshu-u.ac.jp
                  DNS:shirayuri.ac.jp
                  DNS:shizuoka.ac.jp
                  DNS:shodai.ac.jp
                  DNS:shokei.ac.jp
                  DNS:shonan-it.ac.jp
                  DNS:shotoku.ac.jp
                  DNS:shotoku.jp
                  DNS:showa-u.ac.jp
                  DNS:shubun.ac.jp
                  DNS:sinet.ad.jp
                  DNS:sist.ac.jp
                  DNS:siu.ac.jp
                  DNS:socu.ac.jp
                  DNS:sojo-u.ac.jp
                  DNS:soka.ac.jp
                  DNS:soken.ac.jp
                  DNS:spring8.or.jp
                  DNS:sugiyama-u.ac.jp
                  DNS:suzuka-ct.ac.jp
                  DNS:swu.ac.jp
                  DNS:tamagawa.ac.jp
                  DNS:tamagawa.jp
                  DNS:tau.ac.jp
                  DNS:tcu.ac.jp
                  DNS:tcue.ac.jp
                  DNS:tdc.ac.jp
                  DNS:teikyo-u.ac.jp
                  DNS:tenshi.ac.jp
                  DNS:tezukayama-u.ac.jp
                  DNS:tgu.jp
                  DNS:thu.ac.jp
                  DNS:titech.ac.jp
                  DNS:tmd.ac.jp
                  DNS:tnm.jp
                  DNS:toba-cmt.ac.jp
                  DNS:tobunken.go.jp
                  DNS:tohoku.ac.jp
                  DNS:tohoku-gakuin.ac.jp
                  DNS:tohoku-gakuin.jp
                  DNS:tohoku-mpu.ac.jp
                  DNS:toho-u.ac.jp
                  DNS:tohtech.ac.jp
                  DNS:tokiwa.ac.jp
                  DNS:tokoha.ac.jp
                  DNS:tokoha-jc.ac.jp
                  DNS:tokoha-u.ac.jp
                  DNS:tokushima-u.ac.jp
                  DNS:tokuyama.ac.jp
                  DNS:tokyo-ct.ac.jp
                  DNS:tomakomai-ct.ac.jp
                  DNS:tottori-u.ac.jp
                  DNS:toyaku.ac.jp
                  DNS:toyo.ac.jp
                  DNS:toyota-ct.ac.jp
                  DNS:tsukuba.ac.jp
                  DNS:tsukuba-g.ac.jp
                  DNS:tsukuba-tech.ac.jp
                  DNS:tsuru-gakuen.ac.jp
                  DNS:tsurumi-u.ac.jp
                  DNS:tsuruoka-nct.ac.jp
                  DNS:tsuyama-ct.ac.jp
                  DNS:tuat.ac.jp
                  DNS:tufs.ac.jp
                  DNS:tuis.ac.jp
                  DNS:tusy.ac.jp
                  DNS:tut.ac.jp
                  DNS:twcu.ac.jp
                  DNS:u-aizu.ac.jp
                  DNS:ube-k.ac.jp
                  DNS:uec.ac.jp
                  DNS:u-fukui.ac.jp
                  DNS:u-gakugei.ac.jp
                  DNS:u-hyogo.ac.jp
                  DNS:u-kochi.ac.jp
                  DNS:u-nagano.ac.jp
                  DNS:university.jp
                  DNS:uoeh-u.ac.jp
                  DNS:upki.jp
                  DNS:u-ryukyu.ac.jp
                  DNS:u-shimane.ac.jp
                  DNS:u-shizuoka-ken.ac.jp
                  DNS:u-tokyo.ac.jp
                  DNS:u-toyama.ac.jp
                  DNS:utsunomiya-u.ac.jp
                  DNS:wakayama-nct.ac.jp
                  DNS:wakayama-u.ac.jp
                  DNS:wakhok.ac.jp
                  DNS:yamagata-u.ac.jp
                  DNS:yamaguchi-u.ac.jp
                  DNS:yamanashi.ac.jp
                  DNS:ygjc.ac.jp
                  DNS:ygu.ac.jp
                  DNS:ynu.ac.jp
                  DNS:yonago-k.ac.jp
                  DNS:yuge.ac.jp
                  DNS:teikyo-jc.ac.jp
                  DNS:osaka-ue.ac.jp
                  DNS:tsuda.ac.jp
                  DNS:ngu.ac.jp
                  DNS:c2c.ac.jp
                  DNS:aoyama.ac.jp
                  DNS:upc-osaka.ac.jp
                  DNS:fit.jp
                  DNS:fukuoka-wjc.ac.jp
                  DNS:ymu.jp
                  DNS:yux.jp
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DACAA09FFAD8F66EDB6ED69707A827C9E44C1F97C48F0179485F206D707B3E2B
    SPKI SHA256: 6A3FB899BA8E398EDC82D0EA5AD80668B1BAF444A1979F40428715FBE849024F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G5

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B16AE75C8B5865
- SHA-256: 09983A2632C033EB9449C0EBF21F9B8D4A9975C06FB8E20F4A5042E9E4CC6411
- SPKI SHA-256: 6A3FB899BA8E398EDC82D0EA5AD80668B1BAF444A1979F40428715FBE849024F
- Validity: 2020-03-23 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca3/fullcrlg5.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:6a:e7:5c:8b:58:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 23 07:17:36 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                67:3A:3A:C1:6B:B7:1C:A6:41:46:39:30:84:C8:69:00:59:11:58:C1
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Name Constraints:
                Permitted:
                  DNS:agu.ac.jp
                  DNS:aichi-edu.ac.jp
                  DNS:aichi-fam-u.ac.jp
                  DNS:aichi-med-u.ac.jp
                  DNS:aichi-pu.ac.jp
                  DNS:aichi-toho.ac.jp
                  DNS:aichi-u.ac.jp
                  DNS:aitech.ac.jp
                  DNS:akashi.ac.jp
                  DNS:akita-nct.ac.jp
                  DNS:akita-u.ac.jp
                  DNS:anan-nct.ac.jp
                  DNS:andrew.ac.jp
                  DNS:apu.ac.jp
                  DNS:ariake-nct.ac.jp
                  DNS:asahikawa-med.ac.jp
                  DNS:asahikawa-nct.ac.jp
                  DNS:asahi-u.ac.jp
                  DNS:bukkyo-u.ac.jp
                  DNS:bunkyo.ac.jp
                  DNS:bunri-u.ac.jp
                  DNS:chibakoudai.jp
                  DNS:chikyu.ac.jp
                  DNS:chubu.ac.jp
                  DNS:chukyo-u.ac.jp
                  DNS:chuo-u.ac.jp
                  DNS:consortium.or.jp
                  DNS:daido-it.ac.jp
                  DNS:daito.ac.jp
                  DNS:dendai.ac.jp
                  DNS:development-school.jp
                  DNS:dohto.ac.jp
                  DNS:dokkyomed.ac.jp
                  DNS:doshisha.ac.jp
                  DNS:eduroam.jp
                  DNS:ehime-u.ac.jp
                  DNS:enri.go.jp
                  DNS:fcu.ac.jp
                  DNS:fdcnet.ac.jp
                  DNS:ferris.ac.jp
                  DNS:ferris.jp
                  DNS:fit.ac.jp
                  DNS:fmu.ac.jp
                  DNS:fpu.ac.jp
                  DNS:fujita-hu.ac.jp
                  DNS:fukui-nct.ac.jp
                  DNS:fukujo.ac.jp
                  DNS:fukuoka-edu.ac.jp
                  DNS:fukuoka-int-u.ac.jp
                  DNS:fukuoka-u.ac.jp
                  DNS:fukushima-nct.ac.jp
                  DNS:fukushima-u.ac.jp
                  DNS:fukuyama-u.ac.jp
                  DNS:fun.ac.jp
                  DNS:gakunin.jp
                  DNS:gifu-cn.ac.jp
                  DNS:gifu-keizai.ac.jp
                  DNS:gifu-nct.ac.jp
                  DNS:gifu-pu.ac.jp
                  DNS:gifu-u.ac.jp
                  DNS:gku.ac.jp
                  DNS:grips.ac.jp
                  DNS:gunma-ct.ac.jp
                  DNS:gunma-u.ac.jp
                  DNS:hachinohe-ct.ac.jp
                  DNS:hachinohe-u.ac.jp
                  DNS:hakodate-ct.ac.jp
                  DNS:hama-med.ac.jp
                  DNS:heisei-iryou.ac.jp
                  DNS:heisei-u.ac.jp
                  DNS:hgu.jp
                  DNS:hirodai.jp
                  DNS:hirokoudai.jp
                  DNS:hirosaki-u.ac.jp
                  DNS:hiroshima-cmt.ac.jp
                  DNS:hiroshima-cu.ac.jp
                  DNS:hiroshima-u.ac.jp
                  DNS:hiroshima-u.jp
                  DNS:hi-tech.ac.jp
                  DNS:hit-u.ac.jp
                  DNS:hmjc.ac.jp
                  DNS:hokkai-s-u.ac.jp
                  DNS:hokkyodai.ac.jp
                  DNS:hokudai.ac.jp
                  DNS:hoku-iryo-u.ac.jp
                  DNS:hokuriku-u.ac.jp
                  DNS:hyogo-u.ac.jp
                  DNS:iamas.ac.jp
                  DNS:iamas.jp
                  DNS:ibaraki.ac.jp
                  DNS:ibaraki-ct.ac.jp
                  DNS:icc.ac.jp
                  DNS:ichinoseki.ac.jp
                  DNS:icu.ac.jp
                  DNS:igakuken.or.jp
                  DNS:ims.ac.jp
                  DNS:internet.ac.jp
                  DNS:iot.ac.jp
                  DNS:ipmu.jp
                  DNS:iri-tokyo.jp
                  DNS:iroop.jp
                  DNS:ishikawa-nct.ac.jp
                  DNS:ism.ac.jp
                  DNS:it-chiba.ac.jp
                  DNS:it-hiroshima.ac.jp
                  DNS:iwakimu.ac.jp
                  DNS:iwate-med.ac.jp
                  DNS:iwate-u.ac.jp
                  DNS:jaist.ac.jp
                  DNS:jamstec.go.jp
                  DNS:jaxa.jp
                  DNS:j-focus.jp
                  DNS:jichi.ac.jp
                  DNS:jin-ai.ac.jp
                  DNS:jindai.ac.jp
                  DNS:josho.ac.jp
                  DNS:j-parc.jp
                  DNS:jrchcn.ac.jp
                  DNS:jsps.go.jp
                  DNS:juen.ac.jp
                  DNS:kacho-college.ac.jp
                  DNS:kaetsu.ac.jp
                  DNS:kagawa-nct.ac.jp
                  DNS:kagawa-u.ac.jp
                  DNS:kagoshima-ct.ac.jp
                  DNS:kagoshima-u.ac.jp
                  DNS:kaiyodai.ac.jp
                  DNS:kanagawa-it.ac.jp
                  DNS:kanazawa-gu.ac.jp
                  DNS:kanazawa-u.ac.jp
                  DNS:kandai.jp
                  DNS:kansai-u.ac.jp
                  DNS:kasei-gakuin.ac.jp
                  DNS:kbu.ac.jp
                  DNS:kct.ac.jp
                  DNS:kcua.ac.jp
                  DNS:keio.ac.jp
                  DNS:keio.jp
                  DNS:kek.jp
                  DNS:kindai.ac.jp
                  DNS:kinjo-gakuin.jp
                  DNS:kinjo-u.ac.jp
                  DNS:kiryu-u.ac.jp
                  DNS:kisarazu.ac.jp
                  DNS:kit.ac.jp
                  DNS:kit.jp
                  DNS:kitakyu-u.ac.jp
                  DNS:kitami-it.ac.jp
                  DNS:k-junshin.ac.jp
                  DNS:kobe-c.ac.jp
                  DNS:kobe-college.jp
                  DNS:kobe-cufs.ac.jp
                  DNS:kobe-kosen.ac.jp
                  DNS:kobe-tokiwa.ac.jp
                  DNS:kobe-u.ac.jp
                  DNS:kochi-ct.ac.jp
                  DNS:kochi-ct.jp
                  DNS:kochi-ms.ac.jp
                  DNS:kochi-tech.ac.jp
                  DNS:kochi-u.ac.jp
                  DNS:kochi-u.jp
                  DNS:kogakuin.ac.jp
                  DNS:kokugakuin.ac.jp
                  DNS:kokushikan.ac.jp
                  DNS:kosen-ac.jp
                  DNS:kosen-k.go.jp
                  DNS:kppuc.ac.jp
                  DNS:kpu.ac.jp
                  DNS:kpu-m.ac.jp
                  DNS:kuas.ac.jp
                  DNS:kufs.ac.jp
                  DNS:kuins.net
                  DNS:kumagaku.ac.jp
                  DNS:kumamoto-hsu.ac.jp
                  DNS:kumamoto-nct.ac.jp
                  DNS:kumamoto-u.ac.jp
                  DNS:kunitachi.ac.jp
                  DNS:kure-nct.ac.jp
                  DNS:kurume-it.ac.jp
                  DNS:kurume-nct.ac.jp
                  DNS:kurume-shinai.ac.jp
                  DNS:kurume-u.ac.jp
                  DNS:kushiro-ct.ac.jp
                  DNS:kwuc.ac.jp
                  DNS:kyohaku.go.jp
                  DNS:kyokyo-u.ac.jp
                  DNS:kyoto-art.ac.jp
                  DNS:kyoto-econ.ac.jp
                  DNS:kyotogakuen-u.ac.jp
                  DNS:kyotokacho-u.ac.jp
                  DNS:kyoto-su.ac.jp
                  DNS:kyoto-u.ac.jp
                  DNS:kyoto-u.jp
                  DNS:kyoto-wu.ac.jp
                  DNS:kyu-dent.ac.jp
                  DNS:kyukyo-u.ac.jp
                  DNS:kyusan-u.ac.jp
                  DNS:kyushu-u.ac.jp
                  DNS:kyutech.ac.jp
                  DNS:kyutech.jp
                  DNS:maizuru-ct.ac.jp
                  DNS:matsue-ct.ac.jp
                  DNS:matsue-ct.jp
                  DNS:matsuyama-u.ac.jp
                  DNS:matsuyama-u.jp
                  DNS:meiji-u.ac.jp
                  DNS:meio-u.ac.jp
                  DNS:meirin-c.ac.jp
                  DNS:mejiro.ac.jp
                  DNS:metro-cit.ac.jp
                  DNS:mie-u.ac.jp
                  DNS:minpaku.ac.jp
                  DNS:miyakonojo-nct.ac.jp
                  DNS:miyakyo-u.ac.jp
                  DNS:miyasankei-u.ac.jp
                  DNS:miyazaki-mu.ac.jp
                  DNS:miyazaki-u.ac.jp
                  DNS:mpu.ac.jp
                  DNS:muroran-it.ac.jp
                  DNS:musabi.ac.jp
                  DNS:myjuen.jp
                  DNS:my-pharm.ac.jp
                  DNS:myu.ac.jp
                  DNS:nabunken.go.jp
                  DNS:nagano.ac.jp
                  DNS:nagano-nct.ac.jp
                  DNS:nagaoka-ct.ac.jp
                  DNS:nagaokaut.ac.jp
                  DNS:nagasaki-u.ac.jp
                  DNS:nagoya-bunri.ac.jp
                  DNS:nagoya-cu.ac.jp
                  DNS:nagoya-u.ac.jp
                  DNS:nagoya-u.jp
                  DNS:nagoya-wu.ac.jp
                  DNS:naist.jp
                  DNS:nakanishi.ac.jp
                  DNS:nanzan.jp
                  DNS:nanzan-u.ac.jp
                  DNS:nao.ac.jp
                  DNS:nara-edu.ac.jp
                  DNS:narahaku.go.jp
                  DNS:nara-k.ac.jp
                  DNS:naramed-u.ac.jp
                  DNS:nara-wu.ac.jp
                  DNS:naregi.org
                  DNS:naruto-u.ac.jp
                  DNS:ncgg.go.jp
                  DNS:ncgm.go.jp
                  DNS:ncnp.go.jp
                  DNS:nc-toyama.ac.jp
                  DNS:netnfu.ne.jp
                  DNS:neuroinf.jp
                  DNS:nfu.jp
                  DNS:nfu.ne.jp
                  DNS:n-fukushi.ac.jp
                  DNS:nias.ac.jp
                  DNS:nibb.ac.jp
                  DNS:nich.go.jp
                  DNS:nichibun.ac.jp
                  DNS:nifs.ac.jp
                  DNS:nifs-k.ac.jp
                  DNS:nig.ac.jp
                  DNS:nih.go.jp
                  DNS:nihon-u.ac.jp
                  DNS:nihu.jp
                  DNS:nii.ac.jp
                  DNS:niid.go.jp
                  DNS:niigata-u.ac.jp
                  DNS:niihama-nct.ac.jp
                  DNS:nims.go.jp
                  DNS:ninjal.ac.jp
                  DNS:nins.jp
                  DNS:niph.go.jp
                  DNS:nipr.ac.jp
                  DNS:nips.ac.jp
                  DNS:nishogakusha-u.ac.jp
                  DNS:nitech.ac.jp
                  DNS:nitech.jp
                  DNS:nittai.ac.jp
                  DNS:niye.go.jp
                  DNS:nodai.ac.jp
                  DNS:n-seiryo.ac.jp
                  DNS:nua.ac.jp
                  DNS:nuas.ac.jp
                  DNS:nucba.ac.jp
                  DNS:nufs.ac.jp
                  DNS:nuhw.ac.jp
                  DNS:nuis.ac.jp
                  DNS:numazu-ct.ac.jp
                  DNS:nwec.jp
                  DNS:obihiro.ac.jp
                  DNS:obirin.ac.jp
                  DNS:ocha.ac.jp
                  DNS:oist.jp
                  DNS:oit.ac.jp
                  DNS:oita-ct.ac.jp
                  DNS:oita-u.ac.jp
                  DNS:okadai.jp
                  DNS:oka-pu.ac.jp
                  DNS:okayama-u.ac.jp
                  DNS:okinawa-ct.ac.jp
                  DNS:okinawa-u.ac.jp
                  DNS:okiu.ac.jp
                  DNS:onomichi-u.ac.jp
                  DNS:open.ed.jp
                  DNS:osakac.ac.jp
                  DNS:osaka-cu.ac.jp
                  DNS:osakafu-u.ac.jp
                  DNS:osaka-kyoiku.ac.jp
                  DNS:osaka-pct.ac.jp
                  DNS:osaka-u.ac.jp
                  DNS:oshima-k.ac.jp
                  DNS:otani.ac.jp
                  DNS:otaru-uc.ac.jp
                  DNS:otemon.ac.jp
                  DNS:ouhs.ac.jp
                  DNS:ous.ac.jp
                  DNS:oyama-ct.ac.jp
                  DNS:pdbj.org
                  DNS:pu-hiroshima.ac.jp
                  DNS:pu-kumamoto.ac.jp
                  DNS:qst.go.jp
                  DNS:rakuno.ac.jp
                  DNS:rehab.go.jp
                  DNS:reitaku-u.ac.jp
                  DNS:rekihaku.ac.jp
                  DNS:riken.go.jp
                  DNS:riken.jp
                  DNS:rikkyo.ac.jp
                  DNS:rikkyo.ne.jp
                  DNS:ritsumei.ac.jp
                  DNS:rku.ac.jp
                  DNS:rois.ac.jp
                  DNS:ruconsortium.jp
                  DNS:ryukoku.ac.jp
                  DNS:saga-u.ac.jp
                  DNS:saitama-u.ac.jp
                  DNS:sanno.ac.jp
                  DNS:sapmed.ac.jp
                  DNS:sapporo-u.ac.jp
                  DNS:sasebo.ac.jp
                  DNS:scu.ac.jp
                  DNS:seijo.ac.jp
                  DNS:seijoh-u.ac.jp
                  DNS:seikei.ac.jp
                  DNS:seinan-gakuin.jp
                  DNS:seinan-gu.ac.jp
                  DNS:seirei.ac.jp
                  DNS:seisadohto.ac.jp
                  DNS:seisen.ac.jp
                  DNS:seisen-u.ac.jp
                  DNS:sendai-nct.ac.jp
                  DNS:senshu-u.ac.jp
                  DNS:senshu-u.jp
                  DNS:setsunan.ac.jp
                  DNS:sgk.ac.jp
                  DNS:sgu.ac.jp
                  DNS:shibaura-it.ac.jp
                  DNS:shigakkan.jp
                  DNS:shiga-med.ac.jp
                  DNS:shiga-u.ac.jp
                  DNS:shimane-u.ac.jp
                  DNS:shimonoseki-cu.ac.jp
                  DNS:shinonome.ac.jp
                  DNS:shinshu-u.ac.jp
                  DNS:shirayuri.ac.jp
                  DNS:shizuoka.ac.jp
                  DNS:shodai.ac.jp
                  DNS:shokei.ac.jp
                  DNS:shonan-it.ac.jp
                  DNS:shotoku.ac.jp
                  DNS:shotoku.jp
                  DNS:showa-u.ac.jp
                  DNS:shubun.ac.jp
                  DNS:sinet.ad.jp
                  DNS:sist.ac.jp
                  DNS:siu.ac.jp
                  DNS:socu.ac.jp
                  DNS:sojo-u.ac.jp
                  DNS:soka.ac.jp
                  DNS:soken.ac.jp
                  DNS:spring8.or.jp
                  DNS:sugiyama-u.ac.jp
                  DNS:suzuka-ct.ac.jp
                  DNS:swu.ac.jp
                  DNS:tamagawa.ac.jp
                  DNS:tamagawa.jp
                  DNS:tau.ac.jp
                  DNS:tcu.ac.jp
                  DNS:tcue.ac.jp
                  DNS:tdc.ac.jp
                  DNS:teikyo-u.ac.jp
                  DNS:tenshi.ac.jp
                  DNS:tezukayama-u.ac.jp
                  DNS:tgu.jp
                  DNS:thu.ac.jp
                  DNS:titech.ac.jp
                  DNS:tmd.ac.jp
                  DNS:tnm.jp
                  DNS:toba-cmt.ac.jp
                  DNS:tobunken.go.jp
                  DNS:tohoku.ac.jp
                  DNS:tohoku-gakuin.ac.jp
                  DNS:tohoku-gakuin.jp
                  DNS:tohoku-mpu.ac.jp
                  DNS:toho-u.ac.jp
                  DNS:tohtech.ac.jp
                  DNS:tokiwa.ac.jp
                  DNS:tokoha.ac.jp
                  DNS:tokoha-jc.ac.jp
                  DNS:tokoha-u.ac.jp
                  DNS:tokushima-u.ac.jp
                  DNS:tokuyama.ac.jp
                  DNS:tokyo-ct.ac.jp
                  DNS:tomakomai-ct.ac.jp
                  DNS:tottori-u.ac.jp
                  DNS:toyaku.ac.jp
                  DNS:toyo.ac.jp
                  DNS:toyota-ct.ac.jp
                  DNS:tsukuba.ac.jp
                  DNS:tsukuba-g.ac.jp
                  DNS:tsukuba-tech.ac.jp
                  DNS:tsuru-gakuen.ac.jp
                  DNS:tsurumi-u.ac.jp
                  DNS:tsuruoka-nct.ac.jp
                  DNS:tsuyama-ct.ac.jp
                  DNS:tuat.ac.jp
                  DNS:tufs.ac.jp
                  DNS:tuis.ac.jp
                  DNS:tusy.ac.jp
                  DNS:tut.ac.jp
                  DNS:twcu.ac.jp
                  DNS:u-aizu.ac.jp
                  DNS:ube-k.ac.jp
                  DNS:uec.ac.jp
                  DNS:u-fukui.ac.jp
                  DNS:u-gakugei.ac.jp
                  DNS:u-hyogo.ac.jp
                  DNS:u-kochi.ac.jp
                  DNS:u-nagano.ac.jp
                  DNS:university.jp
                  DNS:uoeh-u.ac.jp
                  DNS:upki.jp
                  DNS:u-ryukyu.ac.jp
                  DNS:u-shimane.ac.jp
                  DNS:u-shizuoka-ken.ac.jp
                  DNS:u-tokyo.ac.jp
                  DNS:u-toyama.ac.jp
                  DNS:utsunomiya-u.ac.jp
                  DNS:wakayama-nct.ac.jp
                  DNS:wakayama-u.ac.jp
                  DNS:wakhok.ac.jp
                  DNS:yamagata-u.ac.jp
                  DNS:yamaguchi-u.ac.jp
                  DNS:yamanashi.ac.jp
                  DNS:ygjc.ac.jp
                  DNS:ygu.ac.jp
                  DNS:ynu.ac.jp
                  DNS:yonago-k.ac.jp
                  DNS:yuge.ac.jp
                  DNS:teikyo-jc.ac.jp
                  DNS:osaka-ue.ac.jp
                  DNS:tsuda.ac.jp
                  DNS:ngu.ac.jp
                  DNS:c2c.ac.jp
                  DNS:aoyama.ac.jp
                  DNS:upc-osaka.ac.jp
                  DNS:fit.jp
                  DNS:fukuoka-wjc.ac.jp
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 09983A2632C033EB9449C0EBF21F9B8D4A9975C06FB8E20F4A5042E9E4CC6411
    SPKI SHA256: 6A3FB899BA8E398EDC82D0EA5AD80668B1BAF444A1979F40428715FBE849024F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G5

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B131EC0DFF09FE
- SHA-256: 80F5B0D16FAE8E72B9F1346FEDD78883D4A629D1382FBCFC694F54BFC1EEDD3C
- SPKI SHA-256: 6A3FB899BA8E398EDC82D0EA5AD80668B1BAF444A1979F40428715FBE849024F
- Validity: 2018-03-22 to 2028-03-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:31:ec:0d:ff:09:fe
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 22 06:33:29 2018 GMT
            Not After : Mar 22 06:33:29 2028 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                67:3A:3A:C1:6B:B7:1C:A6:41:46:39:30:84:C8:69:00:59:11:58:C1
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 80F5B0D16FAE8E72B9F1346FEDD78883D4A629D1382FBCFC694F54BFC1EEDD3C
    SPKI SHA256: 6A3FB899BA8E398EDC82D0EA5AD80668B1BAF444A1979F40428715FBE849024F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### NII Open Domain CA - G6

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 0100004730205DD6BB
- SHA-256: 9C669F3AC59B738A5FF6BC70A5D9FD277C3D9E420F31DE234F7149D84E2EF19F
- SPKI SHA-256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
- Validity: 2020-05-20 to 2030-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:47:30:20:5d:d6:bb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: May 20 08:06:19 2020 GMT
            Not After : May 20 08:06:19 2030 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                39:7B:EB:89:7B:E5:2E:D5:F7:1E:95:14:CA:EE:AE:DD:58:94:46:B0
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: https://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
            X509v3 Name Constraints:
                Permitted:
                  DNS:agu.ac.jp
                  DNS:aichi-edu.ac.jp
                  DNS:aichi-fam-u.ac.jp
                  DNS:aichi-med-u.ac.jp
                  DNS:aichi-pu.ac.jp
                  DNS:aichi-toho.ac.jp
                  DNS:aichi-u.ac.jp
                  DNS:aitech.ac.jp
                  DNS:akashi.ac.jp
                  DNS:akita-nct.ac.jp
                  DNS:akita-u.ac.jp
                  DNS:anan-nct.ac.jp
                  DNS:andrew.ac.jp
                  DNS:apu.ac.jp
                  DNS:ariake-nct.ac.jp
                  DNS:asahikawa-med.ac.jp
                  DNS:asahikawa-nct.ac.jp
                  DNS:asahi-u.ac.jp
                  DNS:bukkyo-u.ac.jp
                  DNS:bunkyo.ac.jp
                  DNS:bunri-u.ac.jp
                  DNS:chibakoudai.jp
                  DNS:chikyu.ac.jp
                  DNS:chubu.ac.jp
                  DNS:chukyo-u.ac.jp
                  DNS:chuo-u.ac.jp
                  DNS:consortium.or.jp
                  DNS:daido-it.ac.jp
                  DNS:daito.ac.jp
                  DNS:dendai.ac.jp
                  DNS:development-school.jp
                  DNS:dohto.ac.jp
                  DNS:dokkyomed.ac.jp
                  DNS:doshisha.ac.jp
                  DNS:eduroam.jp
                  DNS:ehime-u.ac.jp
                  DNS:enri.go.jp
                  DNS:fcu.ac.jp
                  DNS:fdcnet.ac.jp
                  DNS:ferris.ac.jp
                  DNS:ferris.jp
                  DNS:fit.ac.jp
                  DNS:fmu.ac.jp
                  DNS:fpu.ac.jp
                  DNS:fujita-hu.ac.jp
                  DNS:fukui-nct.ac.jp
                  DNS:fukujo.ac.jp
                  DNS:fukuoka-edu.ac.jp
                  DNS:fukuoka-int-u.ac.jp
                  DNS:fukuoka-u.ac.jp
                  DNS:fukushima-nct.ac.jp
                  DNS:fukushima-u.ac.jp
                  DNS:fukuyama-u.ac.jp
                  DNS:fun.ac.jp
                  DNS:gakunin.jp
                  DNS:gifu-cn.ac.jp
                  DNS:gifu-keizai.ac.jp
                  DNS:gifu-nct.ac.jp
                  DNS:gifu-pu.ac.jp
                  DNS:gifu-u.ac.jp
                  DNS:gku.ac.jp
                  DNS:grips.ac.jp
                  DNS:gunma-ct.ac.jp
                  DNS:gunma-u.ac.jp
                  DNS:hachinohe-ct.ac.jp
                  DNS:hachinohe-u.ac.jp
                  DNS:hakodate-ct.ac.jp
                  DNS:hama-med.ac.jp
                  DNS:heisei-iryou.ac.jp
                  DNS:heisei-u.ac.jp
                  DNS:hgu.jp
                  DNS:hirodai.jp
                  DNS:hirokoudai.jp
                  DNS:hirosaki-u.ac.jp
                  DNS:hiroshima-cmt.ac.jp
                  DNS:hiroshima-cu.ac.jp
                  DNS:hiroshima-u.ac.jp
                  DNS:hiroshima-u.jp
                  DNS:hi-tech.ac.jp
                  DNS:hit-u.ac.jp
                  DNS:hmjc.ac.jp
                  DNS:hokkai-s-u.ac.jp
                  DNS:hokkyodai.ac.jp
                  DNS:hokudai.ac.jp
                  DNS:hoku-iryo-u.ac.jp
                  DNS:hokuriku-u.ac.jp
                  DNS:hyogo-u.ac.jp
                  DNS:iamas.ac.jp
                  DNS:iamas.jp
                  DNS:ibaraki.ac.jp
                  DNS:ibaraki-ct.ac.jp
                  DNS:icc.ac.jp
                  DNS:ichinoseki.ac.jp
                  DNS:icu.ac.jp
                  DNS:igakuken.or.jp
                  DNS:ims.ac.jp
                  DNS:internet.ac.jp
                  DNS:iot.ac.jp
                  DNS:ipmu.jp
                  DNS:iri-tokyo.jp
                  DNS:iroop.jp
                  DNS:ishikawa-nct.ac.jp
                  DNS:ism.ac.jp
                  DNS:it-chiba.ac.jp
                  DNS:it-hiroshima.ac.jp
                  DNS:iwakimu.ac.jp
                  DNS:iwate-med.ac.jp
                  DNS:iwate-u.ac.jp
                  DNS:jaist.ac.jp
                  DNS:jamstec.go.jp
                  DNS:jaxa.jp
                  DNS:j-focus.jp
                  DNS:jichi.ac.jp
                  DNS:jin-ai.ac.jp
                  DNS:jindai.ac.jp
                  DNS:josho.ac.jp
                  DNS:j-parc.jp
                  DNS:jrchcn.ac.jp
                  DNS:jsps.go.jp
                  DNS:juen.ac.jp
                  DNS:kacho-college.ac.jp
                  DNS:kaetsu.ac.jp
                  DNS:kagawa-nct.ac.jp
                  DNS:kagawa-u.ac.jp
                  DNS:kagoshima-ct.ac.jp
                  DNS:kagoshima-u.ac.jp
                  DNS:kaiyodai.ac.jp
                  DNS:kanagawa-it.ac.jp
                  DNS:kanazawa-gu.ac.jp
                  DNS:kanazawa-u.ac.jp
                  DNS:kandai.jp
                  DNS:kansai-u.ac.jp
                  DNS:kasei-gakuin.ac.jp
                  DNS:kbu.ac.jp
                  DNS:kct.ac.jp
                  DNS:kcua.ac.jp
                  DNS:keio.ac.jp
                  DNS:keio.jp
                  DNS:kek.jp
                  DNS:kindai.ac.jp
                  DNS:kinjo-gakuin.jp
                  DNS:kinjo-u.ac.jp
                  DNS:kiryu-u.ac.jp
                  DNS:kisarazu.ac.jp
                  DNS:kit.ac.jp
                  DNS:kit.jp
                  DNS:kitakyu-u.ac.jp
                  DNS:kitami-it.ac.jp
                  DNS:k-junshin.ac.jp
                  DNS:kobe-c.ac.jp
                  DNS:kobe-college.jp
                  DNS:kobe-cufs.ac.jp
                  DNS:kobe-kosen.ac.jp
                  DNS:kobe-tokiwa.ac.jp
                  DNS:kobe-u.ac.jp
                  DNS:kochi-ct.ac.jp
                  DNS:kochi-ct.jp
                  DNS:kochi-ms.ac.jp
                  DNS:kochi-tech.ac.jp
                  DNS:kochi-u.ac.jp
                  DNS:kochi-u.jp
                  DNS:kogakuin.ac.jp
                  DNS:kokugakuin.ac.jp
                  DNS:kokushikan.ac.jp
                  DNS:kosen-ac.jp
                  DNS:kosen-k.go.jp
                  DNS:kppuc.ac.jp
                  DNS:kpu.ac.jp
                  DNS:kpu-m.ac.jp
                  DNS:kuas.ac.jp
                  DNS:kufs.ac.jp
                  DNS:kuins.net
                  DNS:kumagaku.ac.jp
                  DNS:kumamoto-hsu.ac.jp
                  DNS:kumamoto-nct.ac.jp
                  DNS:kumamoto-u.ac.jp
                  DNS:kunitachi.ac.jp
                  DNS:kure-nct.ac.jp
                  DNS:kurume-it.ac.jp
                  DNS:kurume-nct.ac.jp
                  DNS:kurume-shinai.ac.jp
                  DNS:kurume-u.ac.jp
                  DNS:kushiro-ct.ac.jp
                  DNS:kwuc.ac.jp
                  DNS:kyohaku.go.jp
                  DNS:kyokyo-u.ac.jp
                  DNS:kyoto-art.ac.jp
                  DNS:kyoto-econ.ac.jp
                  DNS:kyotogakuen-u.ac.jp
                  DNS:kyotokacho-u.ac.jp
                  DNS:kyoto-su.ac.jp
                  DNS:kyoto-u.ac.jp
                  DNS:kyoto-u.jp
                  DNS:kyoto-wu.ac.jp
                  DNS:kyu-dent.ac.jp
                  DNS:kyukyo-u.ac.jp
                  DNS:kyusan-u.ac.jp
                  DNS:kyushu-u.ac.jp
                  DNS:kyutech.ac.jp
                  DNS:kyutech.jp
                  DNS:maizuru-ct.ac.jp
                  DNS:matsue-ct.ac.jp
                  DNS:matsue-ct.jp
                  DNS:matsuyama-u.ac.jp
                  DNS:matsuyama-u.jp
                  DNS:meiji-u.ac.jp
                  DNS:meio-u.ac.jp
                  DNS:meirin-c.ac.jp
                  DNS:mejiro.ac.jp
                  DNS:metro-cit.ac.jp
                  DNS:mie-u.ac.jp
                  DNS:minpaku.ac.jp
                  DNS:miyakonojo-nct.ac.jp
                  DNS:miyakyo-u.ac.jp
                  DNS:miyasankei-u.ac.jp
                  DNS:miyazaki-mu.ac.jp
                  DNS:miyazaki-u.ac.jp
                  DNS:mpu.ac.jp
                  DNS:muroran-it.ac.jp
                  DNS:musabi.ac.jp
                  DNS:myjuen.jp
                  DNS:my-pharm.ac.jp
                  DNS:myu.ac.jp
                  DNS:nabunken.go.jp
                  DNS:nagano.ac.jp
                  DNS:nagano-nct.ac.jp
                  DNS:nagaoka-ct.ac.jp
                  DNS:nagaokaut.ac.jp
                  DNS:nagasaki-u.ac.jp
                  DNS:nagoya-bunri.ac.jp
                  DNS:nagoya-cu.ac.jp
                  DNS:nagoya-u.ac.jp
                  DNS:nagoya-u.jp
                  DNS:nagoya-wu.ac.jp
                  DNS:naist.jp
                  DNS:nakanishi.ac.jp
                  DNS:nanzan.jp
                  DNS:nanzan-u.ac.jp
                  DNS:nao.ac.jp
                  DNS:nara-edu.ac.jp
                  DNS:narahaku.go.jp
                  DNS:nara-k.ac.jp
                  DNS:naramed-u.ac.jp
                  DNS:nara-wu.ac.jp
                  DNS:naregi.org
                  DNS:naruto-u.ac.jp
                  DNS:ncgg.go.jp
                  DNS:ncgm.go.jp
                  DNS:ncnp.go.jp
                  DNS:nc-toyama.ac.jp
                  DNS:netnfu.ne.jp
                  DNS:neuroinf.jp
                  DNS:nfu.jp
                  DNS:nfu.ne.jp
                  DNS:n-fukushi.ac.jp
                  DNS:nias.ac.jp
                  DNS:nibb.ac.jp
                  DNS:nich.go.jp
                  DNS:nichibun.ac.jp
                  DNS:nifs.ac.jp
                  DNS:nifs-k.ac.jp
                  DNS:nig.ac.jp
                  DNS:nih.go.jp
                  DNS:nihon-u.ac.jp
                  DNS:nihu.jp
                  DNS:nii.ac.jp
                  DNS:niid.go.jp
                  DNS:niigata-u.ac.jp
                  DNS:niihama-nct.ac.jp
                  DNS:nims.go.jp
                  DNS:ninjal.ac.jp
                  DNS:nins.jp
                  DNS:niph.go.jp
                  DNS:nipr.ac.jp
                  DNS:nips.ac.jp
                  DNS:nishogakusha-u.ac.jp
                  DNS:nitech.ac.jp
                  DNS:nitech.jp
                  DNS:nittai.ac.jp
                  DNS:niye.go.jp
                  DNS:nodai.ac.jp
                  DNS:n-seiryo.ac.jp
                  DNS:nua.ac.jp
                  DNS:nuas.ac.jp
                  DNS:nucba.ac.jp
                  DNS:nufs.ac.jp
                  DNS:nuhw.ac.jp
                  DNS:nuis.ac.jp
                  DNS:numazu-ct.ac.jp
                  DNS:nwec.jp
                  DNS:obihiro.ac.jp
                  DNS:obirin.ac.jp
                  DNS:ocha.ac.jp
                  DNS:oist.jp
                  DNS:oit.ac.jp
                  DNS:oita-ct.ac.jp
                  DNS:oita-u.ac.jp
                  DNS:okadai.jp
                  DNS:oka-pu.ac.jp
                  DNS:okayama-u.ac.jp
                  DNS:okinawa-ct.ac.jp
                  DNS:okinawa-u.ac.jp
                  DNS:okiu.ac.jp
                  DNS:onomichi-u.ac.jp
                  DNS:open.ed.jp
                  DNS:osakac.ac.jp
                  DNS:osaka-cu.ac.jp
                  DNS:osakafu-u.ac.jp
                  DNS:osaka-kyoiku.ac.jp
                  DNS:osaka-pct.ac.jp
                  DNS:osaka-u.ac.jp
                  DNS:oshima-k.ac.jp
                  DNS:otani.ac.jp
                  DNS:otaru-uc.ac.jp
                  DNS:otemon.ac.jp
                  DNS:ouhs.ac.jp
                  DNS:ous.ac.jp
                  DNS:oyama-ct.ac.jp
                  DNS:pdbj.org
                  DNS:pu-hiroshima.ac.jp
                  DNS:pu-kumamoto.ac.jp
                  DNS:qst.go.jp
                  DNS:rakuno.ac.jp
                  DNS:rehab.go.jp
                  DNS:reitaku-u.ac.jp
                  DNS:rekihaku.ac.jp
                  DNS:riken.go.jp
                  DNS:riken.jp
                  DNS:rikkyo.ac.jp
                  DNS:rikkyo.ne.jp
                  DNS:ritsumei.ac.jp
                  DNS:rku.ac.jp
                  DNS:rois.ac.jp
                  DNS:ruconsortium.jp
                  DNS:ryukoku.ac.jp
                  DNS:saga-u.ac.jp
                  DNS:saitama-u.ac.jp
                  DNS:sanno.ac.jp
                  DNS:sapmed.ac.jp
                  DNS:sapporo-u.ac.jp
                  DNS:sasebo.ac.jp
                  DNS:scu.ac.jp
                  DNS:seijo.ac.jp
                  DNS:seijoh-u.ac.jp
                  DNS:seikei.ac.jp
                  DNS:seinan-gakuin.jp
                  DNS:seinan-gu.ac.jp
                  DNS:seirei.ac.jp
                  DNS:seisadohto.ac.jp
                  DNS:seisen.ac.jp
                  DNS:seisen-u.ac.jp
                  DNS:sendai-nct.ac.jp
                  DNS:senshu-u.ac.jp
                  DNS:senshu-u.jp
                  DNS:setsunan.ac.jp
                  DNS:sgk.ac.jp
                  DNS:sgu.ac.jp
                  DNS:shibaura-it.ac.jp
                  DNS:shigakkan.jp
                  DNS:shiga-med.ac.jp
                  DNS:shiga-u.ac.jp
                  DNS:shimane-u.ac.jp
                  DNS:shimonoseki-cu.ac.jp
                  DNS:shinonome.ac.jp
                  DNS:shinshu-u.ac.jp
                  DNS:shirayuri.ac.jp
                  DNS:shizuoka.ac.jp
                  DNS:shodai.ac.jp
                  DNS:shokei.ac.jp
                  DNS:shonan-it.ac.jp
                  DNS:shotoku.ac.jp
                  DNS:shotoku.jp
                  DNS:showa-u.ac.jp
                  DNS:shubun.ac.jp
                  DNS:sinet.ad.jp
                  DNS:sist.ac.jp
                  DNS:siu.ac.jp
                  DNS:socu.ac.jp
                  DNS:sojo-u.ac.jp
                  DNS:soka.ac.jp
                  DNS:soken.ac.jp
                  DNS:spring8.or.jp
                  DNS:sugiyama-u.ac.jp
                  DNS:suzuka-ct.ac.jp
                  DNS:swu.ac.jp
                  DNS:tamagawa.ac.jp
                  DNS:tamagawa.jp
                  DNS:tau.ac.jp
                  DNS:tcu.ac.jp
                  DNS:tcue.ac.jp
                  DNS:tdc.ac.jp
                  DNS:teikyo-u.ac.jp
                  DNS:tenshi.ac.jp
                  DNS:tezukayama-u.ac.jp
                  DNS:tgu.jp
                  DNS:thu.ac.jp
                  DNS:titech.ac.jp
                  DNS:tmd.ac.jp
                  DNS:tnm.jp
                  DNS:toba-cmt.ac.jp
                  DNS:tobunken.go.jp
                  DNS:tohoku.ac.jp
                  DNS:tohoku-gakuin.ac.jp
                  DNS:tohoku-gakuin.jp
                  DNS:tohoku-mpu.ac.jp
                  DNS:toho-u.ac.jp
                  DNS:tohtech.ac.jp
                  DNS:tokiwa.ac.jp
                  DNS:tokoha.ac.jp
                  DNS:tokoha-jc.ac.jp
                  DNS:tokoha-u.ac.jp
                  DNS:tokushima-u.ac.jp
                  DNS:tokuyama.ac.jp
                  DNS:tokyo-ct.ac.jp
                  DNS:tomakomai-ct.ac.jp
                  DNS:tottori-u.ac.jp
                  DNS:toyaku.ac.jp
                  DNS:toyo.ac.jp
                  DNS:toyota-ct.ac.jp
                  DNS:tsukuba.ac.jp
                  DNS:tsukuba-g.ac.jp
                  DNS:tsukuba-tech.ac.jp
                  DNS:tsuru-gakuen.ac.jp
                  DNS:tsurumi-u.ac.jp
                  DNS:tsuruoka-nct.ac.jp
                  DNS:tsuyama-ct.ac.jp
                  DNS:tuat.ac.jp
                  DNS:tufs.ac.jp
                  DNS:tuis.ac.jp
                  DNS:tusy.ac.jp
                  DNS:tut.ac.jp
                  DNS:twcu.ac.jp
                  DNS:u-aizu.ac.jp
                  DNS:ube-k.ac.jp
                  DNS:uec.ac.jp
                  DNS:u-fukui.ac.jp
                  DNS:u-gakugei.ac.jp
                  DNS:u-hyogo.ac.jp
                  DNS:u-kochi.ac.jp
                  DNS:u-nagano.ac.jp
                  DNS:university.jp
                  DNS:uoeh-u.ac.jp
                  DNS:upki.jp
                  DNS:u-ryukyu.ac.jp
                  DNS:u-shimane.ac.jp
                  DNS:u-shizuoka-ken.ac.jp
                  DNS:u-tokyo.ac.jp
                  DNS:u-toyama.ac.jp
                  DNS:utsunomiya-u.ac.jp
                  DNS:wakayama-nct.ac.jp
                  DNS:wakayama-u.ac.jp
                  DNS:wakhok.ac.jp
                  DNS:yamagata-u.ac.jp
                  DNS:yamaguchi-u.ac.jp
                  DNS:yamanashi.ac.jp
                  DNS:ygjc.ac.jp
                  DNS:ygu.ac.jp
                  DNS:ynu.ac.jp
                  DNS:yonago-k.ac.jp
                  DNS:yuge.ac.jp
                  DNS:teikyo-jc.ac.jp
                  DNS:osaka-ue.ac.jp
                  DNS:tsuda.ac.jp
                  DNS:ngu.ac.jp
                  DNS:c2c.ac.jp
                  DNS:aoyama.ac.jp
                  DNS:upc-osaka.ac.jp
                  DNS:fit.jp
                  DNS:fukuoka-wjc.ac.jp
                  DNS:ymu.jp
                  DNS:yux.jp
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9C669F3AC59B738A5FF6BC70A5D9FD277C3D9E420F31DE234F7149D84E2EF19F
    SPKI SHA256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G6

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 01000039CB7FBC57A3
- SHA-256: 76BD451EBB1A86332C608D9993878610831855717D7B9D6B82B3CDE7276E6B75
- SPKI SHA-256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
- Validity: 2018-03-22 to 2028-03-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:39:cb:7f:bc:57:a3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Mar 22 06:53:18 2018 GMT
            Not After : Mar 22 06:53:18 2028 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                39:7B:EB:89:7B:E5:2E:D5:F7:1E:95:14:CA:EE:AE:DD:58:94:46:B0
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: https://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 76BD451EBB1A86332C608D9993878610831855717D7B9D6B82B3CDE7276E6B75
    SPKI SHA256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### NII Open Domain CA - G6

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 0100003E080F4D9A37
- SHA-256: 012BB72AAA11068FC84E276CA1D41E0D67D546B204F53C417EAF471047F67460
- SPKI SHA-256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
- Validity: 2019-03-14 to 2029-03-14
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca3/fullcrlg6.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:3e:08:0f:4d:9a:37
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Mar 14 01:39:40 2019 GMT
            Not After : Mar 14 01:39:40 2029 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                39:7B:EB:89:7B:E5:2E:D5:F7:1E:95:14:CA:EE:AE:DD:58:94:46:B0
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: https://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 012BB72AAA11068FC84E276CA1D41E0D67D546B204F53C417EAF471047F67460
    SPKI SHA256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G6

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain CA - G6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 010000453DF48BE746
- SHA-256: AE59CD71C4DEE107DC3B54B144CA0630B60CCF01A1461AB6D2AD0AC41FA33826
- SPKI SHA-256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
- Validity: 2020-03-23 to 2030-03-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:45:3d:f4:8b:e7:46
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Mar 23 08:13:43 2020 GMT
            Not After : Mar 23 08:13:43 2030 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain CA - G6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                39:7B:EB:89:7B:E5:2E:D5:F7:1E:95:14:CA:EE:AE:DD:58:94:46:B0
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: https://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
            X509v3 Name Constraints:
                Permitted:
                  DNS:agu.ac.jp
                  DNS:aichi-edu.ac.jp
                  DNS:aichi-fam-u.ac.jp
                  DNS:aichi-med-u.ac.jp
                  DNS:aichi-pu.ac.jp
                  DNS:aichi-toho.ac.jp
                  DNS:aichi-u.ac.jp
                  DNS:aitech.ac.jp
                  DNS:akashi.ac.jp
                  DNS:akita-nct.ac.jp
                  DNS:akita-u.ac.jp
                  DNS:anan-nct.ac.jp
                  DNS:andrew.ac.jp
                  DNS:apu.ac.jp
                  DNS:ariake-nct.ac.jp
                  DNS:asahikawa-med.ac.jp
                  DNS:asahikawa-nct.ac.jp
                  DNS:asahi-u.ac.jp
                  DNS:bukkyo-u.ac.jp
                  DNS:bunkyo.ac.jp
                  DNS:bunri-u.ac.jp
                  DNS:chibakoudai.jp
                  DNS:chikyu.ac.jp
                  DNS:chubu.ac.jp
                  DNS:chukyo-u.ac.jp
                  DNS:chuo-u.ac.jp
                  DNS:consortium.or.jp
                  DNS:daido-it.ac.jp
                  DNS:daito.ac.jp
                  DNS:dendai.ac.jp
                  DNS:development-school.jp
                  DNS:dohto.ac.jp
                  DNS:dokkyomed.ac.jp
                  DNS:doshisha.ac.jp
                  DNS:eduroam.jp
                  DNS:ehime-u.ac.jp
                  DNS:enri.go.jp
                  DNS:fcu.ac.jp
                  DNS:fdcnet.ac.jp
                  DNS:ferris.ac.jp
                  DNS:ferris.jp
                  DNS:fit.ac.jp
                  DNS:fmu.ac.jp
                  DNS:fpu.ac.jp
                  DNS:fujita-hu.ac.jp
                  DNS:fukui-nct.ac.jp
                  DNS:fukujo.ac.jp
                  DNS:fukuoka-edu.ac.jp
                  DNS:fukuoka-int-u.ac.jp
                  DNS:fukuoka-u.ac.jp
                  DNS:fukushima-nct.ac.jp
                  DNS:fukushima-u.ac.jp
                  DNS:fukuyama-u.ac.jp
                  DNS:fun.ac.jp
                  DNS:gakunin.jp
                  DNS:gifu-cn.ac.jp
                  DNS:gifu-keizai.ac.jp
                  DNS:gifu-nct.ac.jp
                  DNS:gifu-pu.ac.jp
                  DNS:gifu-u.ac.jp
                  DNS:gku.ac.jp
                  DNS:grips.ac.jp
                  DNS:gunma-ct.ac.jp
                  DNS:gunma-u.ac.jp
                  DNS:hachinohe-ct.ac.jp
                  DNS:hachinohe-u.ac.jp
                  DNS:hakodate-ct.ac.jp
                  DNS:hama-med.ac.jp
                  DNS:heisei-iryou.ac.jp
                  DNS:heisei-u.ac.jp
                  DNS:hgu.jp
                  DNS:hirodai.jp
                  DNS:hirokoudai.jp
                  DNS:hirosaki-u.ac.jp
                  DNS:hiroshima-cmt.ac.jp
                  DNS:hiroshima-cu.ac.jp
                  DNS:hiroshima-u.ac.jp
                  DNS:hiroshima-u.jp
                  DNS:hi-tech.ac.jp
                  DNS:hit-u.ac.jp
                  DNS:hmjc.ac.jp
                  DNS:hokkai-s-u.ac.jp
                  DNS:hokkyodai.ac.jp
                  DNS:hokudai.ac.jp
                  DNS:hoku-iryo-u.ac.jp
                  DNS:hokuriku-u.ac.jp
                  DNS:hyogo-u.ac.jp
                  DNS:iamas.ac.jp
                  DNS:iamas.jp
                  DNS:ibaraki.ac.jp
                  DNS:ibaraki-ct.ac.jp
                  DNS:icc.ac.jp
                  DNS:ichinoseki.ac.jp
                  DNS:icu.ac.jp
                  DNS:igakuken.or.jp
                  DNS:ims.ac.jp
                  DNS:internet.ac.jp
                  DNS:iot.ac.jp
                  DNS:ipmu.jp
                  DNS:iri-tokyo.jp
                  DNS:iroop.jp
                  DNS:ishikawa-nct.ac.jp
                  DNS:ism.ac.jp
                  DNS:it-chiba.ac.jp
                  DNS:it-hiroshima.ac.jp
                  DNS:iwakimu.ac.jp
                  DNS:iwate-med.ac.jp
                  DNS:iwate-u.ac.jp
                  DNS:jaist.ac.jp
                  DNS:jamstec.go.jp
                  DNS:jaxa.jp
                  DNS:j-focus.jp
                  DNS:jichi.ac.jp
                  DNS:jin-ai.ac.jp
                  DNS:jindai.ac.jp
                  DNS:josho.ac.jp
                  DNS:j-parc.jp
                  DNS:jrchcn.ac.jp
                  DNS:jsps.go.jp
                  DNS:juen.ac.jp
                  DNS:kacho-college.ac.jp
                  DNS:kaetsu.ac.jp
                  DNS:kagawa-nct.ac.jp
                  DNS:kagawa-u.ac.jp
                  DNS:kagoshima-ct.ac.jp
                  DNS:kagoshima-u.ac.jp
                  DNS:kaiyodai.ac.jp
                  DNS:kanagawa-it.ac.jp
                  DNS:kanazawa-gu.ac.jp
                  DNS:kanazawa-u.ac.jp
                  DNS:kandai.jp
                  DNS:kansai-u.ac.jp
                  DNS:kasei-gakuin.ac.jp
                  DNS:kbu.ac.jp
                  DNS:kct.ac.jp
                  DNS:kcua.ac.jp
                  DNS:keio.ac.jp
                  DNS:keio.jp
                  DNS:kek.jp
                  DNS:kindai.ac.jp
                  DNS:kinjo-gakuin.jp
                  DNS:kinjo-u.ac.jp
                  DNS:kiryu-u.ac.jp
                  DNS:kisarazu.ac.jp
                  DNS:kit.ac.jp
                  DNS:kit.jp
                  DNS:kitakyu-u.ac.jp
                  DNS:kitami-it.ac.jp
                  DNS:k-junshin.ac.jp
                  DNS:kobe-c.ac.jp
                  DNS:kobe-college.jp
                  DNS:kobe-cufs.ac.jp
                  DNS:kobe-kosen.ac.jp
                  DNS:kobe-tokiwa.ac.jp
                  DNS:kobe-u.ac.jp
                  DNS:kochi-ct.ac.jp
                  DNS:kochi-ct.jp
                  DNS:kochi-ms.ac.jp
                  DNS:kochi-tech.ac.jp
                  DNS:kochi-u.ac.jp
                  DNS:kochi-u.jp
                  DNS:kogakuin.ac.jp
                  DNS:kokugakuin.ac.jp
                  DNS:kokushikan.ac.jp
                  DNS:kosen-ac.jp
                  DNS:kosen-k.go.jp
                  DNS:kppuc.ac.jp
                  DNS:kpu.ac.jp
                  DNS:kpu-m.ac.jp
                  DNS:kuas.ac.jp
                  DNS:kufs.ac.jp
                  DNS:kuins.net
                  DNS:kumagaku.ac.jp
                  DNS:kumamoto-hsu.ac.jp
                  DNS:kumamoto-nct.ac.jp
                  DNS:kumamoto-u.ac.jp
                  DNS:kunitachi.ac.jp
                  DNS:kure-nct.ac.jp
                  DNS:kurume-it.ac.jp
                  DNS:kurume-nct.ac.jp
                  DNS:kurume-shinai.ac.jp
                  DNS:kurume-u.ac.jp
                  DNS:kushiro-ct.ac.jp
                  DNS:kwuc.ac.jp
                  DNS:kyohaku.go.jp
                  DNS:kyokyo-u.ac.jp
                  DNS:kyoto-art.ac.jp
                  DNS:kyoto-econ.ac.jp
                  DNS:kyotogakuen-u.ac.jp
                  DNS:kyotokacho-u.ac.jp
                  DNS:kyoto-su.ac.jp
                  DNS:kyoto-u.ac.jp
                  DNS:kyoto-u.jp
                  DNS:kyoto-wu.ac.jp
                  DNS:kyu-dent.ac.jp
                  DNS:kyukyo-u.ac.jp
                  DNS:kyusan-u.ac.jp
                  DNS:kyushu-u.ac.jp
                  DNS:kyutech.ac.jp
                  DNS:kyutech.jp
                  DNS:maizuru-ct.ac.jp
                  DNS:matsue-ct.ac.jp
                  DNS:matsue-ct.jp
                  DNS:matsuyama-u.ac.jp
                  DNS:matsuyama-u.jp
                  DNS:meiji-u.ac.jp
                  DNS:meio-u.ac.jp
                  DNS:meirin-c.ac.jp
                  DNS:mejiro.ac.jp
                  DNS:metro-cit.ac.jp
                  DNS:mie-u.ac.jp
                  DNS:minpaku.ac.jp
                  DNS:miyakonojo-nct.ac.jp
                  DNS:miyakyo-u.ac.jp
                  DNS:miyasankei-u.ac.jp
                  DNS:miyazaki-mu.ac.jp
                  DNS:miyazaki-u.ac.jp
                  DNS:mpu.ac.jp
                  DNS:muroran-it.ac.jp
                  DNS:musabi.ac.jp
                  DNS:myjuen.jp
                  DNS:my-pharm.ac.jp
                  DNS:myu.ac.jp
                  DNS:nabunken.go.jp
                  DNS:nagano.ac.jp
                  DNS:nagano-nct.ac.jp
                  DNS:nagaoka-ct.ac.jp
                  DNS:nagaokaut.ac.jp
                  DNS:nagasaki-u.ac.jp
                  DNS:nagoya-bunri.ac.jp
                  DNS:nagoya-cu.ac.jp
                  DNS:nagoya-u.ac.jp
                  DNS:nagoya-u.jp
                  DNS:nagoya-wu.ac.jp
                  DNS:naist.jp
                  DNS:nakanishi.ac.jp
                  DNS:nanzan.jp
                  DNS:nanzan-u.ac.jp
                  DNS:nao.ac.jp
                  DNS:nara-edu.ac.jp
                  DNS:narahaku.go.jp
                  DNS:nara-k.ac.jp
                  DNS:naramed-u.ac.jp
                  DNS:nara-wu.ac.jp
                  DNS:naregi.org
                  DNS:naruto-u.ac.jp
                  DNS:ncgg.go.jp
                  DNS:ncgm.go.jp
                  DNS:ncnp.go.jp
                  DNS:nc-toyama.ac.jp
                  DNS:netnfu.ne.jp
                  DNS:neuroinf.jp
                  DNS:nfu.jp
                  DNS:nfu.ne.jp
                  DNS:n-fukushi.ac.jp
                  DNS:nias.ac.jp
                  DNS:nibb.ac.jp
                  DNS:nich.go.jp
                  DNS:nichibun.ac.jp
                  DNS:nifs.ac.jp
                  DNS:nifs-k.ac.jp
                  DNS:nig.ac.jp
                  DNS:nih.go.jp
                  DNS:nihon-u.ac.jp
                  DNS:nihu.jp
                  DNS:nii.ac.jp
                  DNS:niid.go.jp
                  DNS:niigata-u.ac.jp
                  DNS:niihama-nct.ac.jp
                  DNS:nims.go.jp
                  DNS:ninjal.ac.jp
                  DNS:nins.jp
                  DNS:niph.go.jp
                  DNS:nipr.ac.jp
                  DNS:nips.ac.jp
                  DNS:nishogakusha-u.ac.jp
                  DNS:nitech.ac.jp
                  DNS:nitech.jp
                  DNS:nittai.ac.jp
                  DNS:niye.go.jp
                  DNS:nodai.ac.jp
                  DNS:n-seiryo.ac.jp
                  DNS:nua.ac.jp
                  DNS:nuas.ac.jp
                  DNS:nucba.ac.jp
                  DNS:nufs.ac.jp
                  DNS:nuhw.ac.jp
                  DNS:nuis.ac.jp
                  DNS:numazu-ct.ac.jp
                  DNS:nwec.jp
                  DNS:obihiro.ac.jp
                  DNS:obirin.ac.jp
                  DNS:ocha.ac.jp
                  DNS:oist.jp
                  DNS:oit.ac.jp
                  DNS:oita-ct.ac.jp
                  DNS:oita-u.ac.jp
                  DNS:okadai.jp
                  DNS:oka-pu.ac.jp
                  DNS:okayama-u.ac.jp
                  DNS:okinawa-ct.ac.jp
                  DNS:okinawa-u.ac.jp
                  DNS:okiu.ac.jp
                  DNS:onomichi-u.ac.jp
                  DNS:open.ed.jp
                  DNS:osakac.ac.jp
                  DNS:osaka-cu.ac.jp
                  DNS:osakafu-u.ac.jp
                  DNS:osaka-kyoiku.ac.jp
                  DNS:osaka-pct.ac.jp
                  DNS:osaka-u.ac.jp
                  DNS:oshima-k.ac.jp
                  DNS:otani.ac.jp
                  DNS:otaru-uc.ac.jp
                  DNS:otemon.ac.jp
                  DNS:ouhs.ac.jp
                  DNS:ous.ac.jp
                  DNS:oyama-ct.ac.jp
                  DNS:pdbj.org
                  DNS:pu-hiroshima.ac.jp
                  DNS:pu-kumamoto.ac.jp
                  DNS:qst.go.jp
                  DNS:rakuno.ac.jp
                  DNS:rehab.go.jp
                  DNS:reitaku-u.ac.jp
                  DNS:rekihaku.ac.jp
                  DNS:riken.go.jp
                  DNS:riken.jp
                  DNS:rikkyo.ac.jp
                  DNS:rikkyo.ne.jp
                  DNS:ritsumei.ac.jp
                  DNS:rku.ac.jp
                  DNS:rois.ac.jp
                  DNS:ruconsortium.jp
                  DNS:ryukoku.ac.jp
                  DNS:saga-u.ac.jp
                  DNS:saitama-u.ac.jp
                  DNS:sanno.ac.jp
                  DNS:sapmed.ac.jp
                  DNS:sapporo-u.ac.jp
                  DNS:sasebo.ac.jp
                  DNS:scu.ac.jp
                  DNS:seijo.ac.jp
                  DNS:seijoh-u.ac.jp
                  DNS:seikei.ac.jp
                  DNS:seinan-gakuin.jp
                  DNS:seinan-gu.ac.jp
                  DNS:seirei.ac.jp
                  DNS:seisadohto.ac.jp
                  DNS:seisen.ac.jp
                  DNS:seisen-u.ac.jp
                  DNS:sendai-nct.ac.jp
                  DNS:senshu-u.ac.jp
                  DNS:senshu-u.jp
                  DNS:setsunan.ac.jp
                  DNS:sgk.ac.jp
                  DNS:sgu.ac.jp
                  DNS:shibaura-it.ac.jp
                  DNS:shigakkan.jp
                  DNS:shiga-med.ac.jp
                  DNS:shiga-u.ac.jp
                  DNS:shimane-u.ac.jp
                  DNS:shimonoseki-cu.ac.jp
                  DNS:shinonome.ac.jp
                  DNS:shinshu-u.ac.jp
                  DNS:shirayuri.ac.jp
                  DNS:shizuoka.ac.jp
                  DNS:shodai.ac.jp
                  DNS:shokei.ac.jp
                  DNS:shonan-it.ac.jp
                  DNS:shotoku.ac.jp
                  DNS:shotoku.jp
                  DNS:showa-u.ac.jp
                  DNS:shubun.ac.jp
                  DNS:sinet.ad.jp
                  DNS:sist.ac.jp
                  DNS:siu.ac.jp
                  DNS:socu.ac.jp
                  DNS:sojo-u.ac.jp
                  DNS:soka.ac.jp
                  DNS:soken.ac.jp
                  DNS:spring8.or.jp
                  DNS:sugiyama-u.ac.jp
                  DNS:suzuka-ct.ac.jp
                  DNS:swu.ac.jp
                  DNS:tamagawa.ac.jp
                  DNS:tamagawa.jp
                  DNS:tau.ac.jp
                  DNS:tcu.ac.jp
                  DNS:tcue.ac.jp
                  DNS:tdc.ac.jp
                  DNS:teikyo-u.ac.jp
                  DNS:tenshi.ac.jp
                  DNS:tezukayama-u.ac.jp
                  DNS:tgu.jp
                  DNS:thu.ac.jp
                  DNS:titech.ac.jp
                  DNS:tmd.ac.jp
                  DNS:tnm.jp
                  DNS:toba-cmt.ac.jp
                  DNS:tobunken.go.jp
                  DNS:tohoku.ac.jp
                  DNS:tohoku-gakuin.ac.jp
                  DNS:tohoku-gakuin.jp
                  DNS:tohoku-mpu.ac.jp
                  DNS:toho-u.ac.jp
                  DNS:tohtech.ac.jp
                  DNS:tokiwa.ac.jp
                  DNS:tokoha.ac.jp
                  DNS:tokoha-jc.ac.jp
                  DNS:tokoha-u.ac.jp
                  DNS:tokushima-u.ac.jp
                  DNS:tokuyama.ac.jp
                  DNS:tokyo-ct.ac.jp
                  DNS:tomakomai-ct.ac.jp
                  DNS:tottori-u.ac.jp
                  DNS:toyaku.ac.jp
                  DNS:toyo.ac.jp
                  DNS:toyota-ct.ac.jp
                  DNS:tsukuba.ac.jp
                  DNS:tsukuba-g.ac.jp
                  DNS:tsukuba-tech.ac.jp
                  DNS:tsuru-gakuen.ac.jp
                  DNS:tsurumi-u.ac.jp
                  DNS:tsuruoka-nct.ac.jp
                  DNS:tsuyama-ct.ac.jp
                  DNS:tuat.ac.jp
                  DNS:tufs.ac.jp
                  DNS:tuis.ac.jp
                  DNS:tusy.ac.jp
                  DNS:tut.ac.jp
                  DNS:twcu.ac.jp
                  DNS:u-aizu.ac.jp
                  DNS:ube-k.ac.jp
                  DNS:uec.ac.jp
                  DNS:u-fukui.ac.jp
                  DNS:u-gakugei.ac.jp
                  DNS:u-hyogo.ac.jp
                  DNS:u-kochi.ac.jp
                  DNS:u-nagano.ac.jp
                  DNS:university.jp
                  DNS:uoeh-u.ac.jp
                  DNS:upki.jp
                  DNS:u-ryukyu.ac.jp
                  DNS:u-shimane.ac.jp
                  DNS:u-shizuoka-ken.ac.jp
                  DNS:u-tokyo.ac.jp
                  DNS:u-toyama.ac.jp
                  DNS:utsunomiya-u.ac.jp
                  DNS:wakayama-nct.ac.jp
                  DNS:wakayama-u.ac.jp
                  DNS:wakhok.ac.jp
                  DNS:yamagata-u.ac.jp
                  DNS:yamaguchi-u.ac.jp
                  DNS:yamanashi.ac.jp
                  DNS:ygjc.ac.jp
                  DNS:ygu.ac.jp
                  DNS:ynu.ac.jp
                  DNS:yonago-k.ac.jp
                  DNS:yuge.ac.jp
                  DNS:teikyo-jc.ac.jp
                  DNS:osaka-ue.ac.jp
                  DNS:tsuda.ac.jp
                  DNS:ngu.ac.jp
                  DNS:c2c.ac.jp
                  DNS:aoyama.ac.jp
                  DNS:upc-osaka.ac.jp
                  DNS:fit.jp
                  DNS:fukuoka-wjc.ac.jp
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AE59CD71C4DEE107DC3B54B144CA0630B60CCF01A1461AB6D2AD0AC41FA33826
    SPKI SHA256: 737A25AF01CA0C19D4126523AF8C89D3867F7593F807D448B1D9B30922D5A0ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_name_constraints_not_critical: 
- [historical] warn w_sub_ca_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G7 ECC

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=NII Open Domain CA - G7 ECC
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 0100004C9F5DEB113CD4FB41C8C9EC7D
- SHA-256: 81CD03067252FFE849B240DCC24566678677E3F5FEDC4C540D7A26CAD2C081C8
- SPKI SHA-256: F49358334E017DF1268773840D41780EADE78BB4CD085ED9C7522D4276636D56
- Validity: 2020-12-15 to 2030-12-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca4/fullcrlg7ecc.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:4c:9f:5d:eb:11:3c:d4:fb:41:c8:c9:ec:7d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Dec 15 09:17:38 2020 GMT
            Not After : Dec 15 09:17:38 2030 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = NII Open Domain CA - G7 ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                6B:30:20:0C:AE:B7:C3:13:9B:D9:A7:59:17:8A:5E:30:C1:4C:55:49
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: http://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 81CD03067252FFE849B240DCC24566678677E3F5FEDC4C540D7A26CAD2C081C8
    SPKI SHA256: F49358334E017DF1268773840D41780EADE78BB4CD085ED9C7522D4276636D56
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G7 RSA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=NII Open Domain CA - G7 RSA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18587A69943B5EC368F4CAF68F7
- SHA-256: 603DB707A584003BED6F1D43DCD4EAE13CD18D798E827DE2F3A31F3193FC0DAC
- SPKI SHA-256: 81D7266DB3BEF8E6E75ADB87E6CFB7C3B9734226252DE5F2306B8767B6E0686D
- Validity: 2020-12-15 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca4/fullcrlg7rsa.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:85:87:a6:99:43:b5:ec:36:8f:4c:af:68:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 15 08:46:22 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = NII Open Domain CA - G7 RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                B0:2E:E5:51:ED:FC:4A:CF:A3:87:F1:13:90:76:2D:9D:8E:94:A1:E3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 603DB707A584003BED6F1D43DCD4EAE13CD18D798E827DE2F3A31F3193FC0DAC
    SPKI SHA256: 81D7266DB3BEF8E6E75ADB87E6CFB7C3B9734226252DE5F2306B8767B6E0686D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G8 ECC

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=NII Open Domain CA - G8 ECC
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024
- Serial: 4FE6B3FB540841C0726E0B9B337F2931
- SHA-256: 287BA7D22607D566B8372EB18D3115AEF037A84FFC1932BFB4B5200DFA60064B
- SPKI SHA-256: C4275E0201323154280E2A91B5C47B18A1F83F1DF3B6F250D3710DB9FD632018
- Validity: 2026-08-05 to 2029-06-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca4/fullcrlg8ecc.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tlseccrootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:e6:b3:fb:54:08:41:c0:72:6e:0b:9b:33:7f:29:31
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS ECC Root CA 2024
        Validity
            Not Before: Aug  5 04:56:54 2026 GMT
            Not After : Jun  5 00:00:00 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = NII Open Domain CA - G8 ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
            X509v3 Subject Key Identifier:
                23:CF:77:FC:5F:86:FF:45:66:14:B2:8A:B6:D2:CA:DA:55:67:EE:25
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlseccrootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsecc/tlseccrootca2024.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 287BA7D22607D566B8372EB18D3115AEF037A84FFC1932BFB4B5200DFA60064B
    SPKI SHA256: C4275E0201323154280E2A91B5C47B18A1F83F1DF3B6F250D3710DB9FD632018
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://tlseccrootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsecc/tlseccrootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain CA - G8 RSA

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=NII Open Domain CA - G8 RSA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Serial: 47A591269A792F7FE456F83343A5ABD7
- SHA-256: 7A4AD9E1BA2DFB08F752A124032F7058868062E9841785623EB4136783A53FFC
- SPKI SHA-256: D47E8C1A32CFB45472605952A3802CB347F79823BC355D1E1755773315DCF76E
- Validity: 2025-08-21 to 2040-08-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca4/fullcrlg8rsa.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.11
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:a5:91:26:9a:79:2f:7f:e4:56:f8:33:43:a5:ab:d7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Validity
            Not Before: Aug 21 05:06:58 2025 GMT
            Not After : Aug 21 00:00:00 2040 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = NII Open Domain CA - G8 RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Subject Key Identifier:
                92:AA:38:B1:18:5A:2B:5C:4B:E7:A1:0A:40:A5:F2:44:29:D8:C0:53
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.901.11
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlsrsarootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7A4AD9E1BA2DFB08F752A124032F7058868062E9841785623EB4136783A53FFC
    SPKI SHA256: D47E8C1A32CFB45472605952A3802CB347F79823BC355D1E1755773315DCF76E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.11
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### NII Open Domain ClientAuth CA

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain ClientAuth CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1688E7494D662
- SHA-256: E36AD28CF463390820DF1217AA342658E7AB04B4930D1BFA30F1A93C8358360E
- SPKI SHA-256: 6436D2B7ADCA09CA1BF993919D7973BC9E1B8B1796B4888525DF0B44D5C8C4CB
- Validity: 2020-03-05 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:68:8e:74:94:d6:62
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar  5 01:13:57 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain ClientAuth CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                24:77:3A:F2:35:8B:38:12:7A:00:EA:04:B2:33:BB:05:3A:D6:6F:4C
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E36AD28CF463390820DF1217AA342658E7AB04B4930D1BFA30F1A93C8358360E
    SPKI SHA256: 6436D2B7ADCA09CA1BF993919D7973BC9E1B8B1796B4888525DF0B44D5C8C4CB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### NII Open Domain Code Signing CA

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain Code Signing CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0F8
- SHA-256: 1E55B90479A737E78B56F39CB570514A2B1DCBD9AF249C061886837A987C6958
- SPKI SHA-256: 9B7984F199CAF0767D8F3273F5EB8879FB445268B7EC692040F7AE08240923CA
- Validity: 2015-02-26 to 2023-02-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159352 (0x12b9b0f8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Feb 26 05:53:41 2015 GMT
            Not After : Feb 22 05:53:41 2023 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                10:F8:38:D2:3C:2A:D4:A1:DB:28:34:88:6F:B3:B6:78:1E:05:DD:9E
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1E55B90479A737E78B56F39CB570514A2B1DCBD9AF249C061886837A987C6958
    SPKI SHA256: 9B7984F199CAF0767D8F3273F5EB8879FB445268B7EC692040F7AE08240923CA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### NII Open Domain Code Signing CA - G2

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain Code Signing CA - G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0D6
- SHA-256: 7F9D66A7964E27654B7677464C24A786548C9774504C15C38449B4419FF38B5F
- SPKI SHA-256: E08DC6F570A96474A5E677D8E915B1ECDA6A9D8E284677A52FD3B837D9E25A7C
- Validity: 2015-02-26 to 2025-02-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594774 (0x22b9b0d6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Feb 26 06:29:52 2015 GMT
            Not After : Feb 26 06:29:52 2025 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain Code Signing CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                54:D7:38:DE:1A:B9:49:CB:FF:BB:28:63:E7:27:1F:AB:5E:2A:24:47
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7F9D66A7964E27654B7677464C24A786548C9774504C15C38449B4419FF38B5F
    SPKI SHA256: E08DC6F570A96474A5E677D8E915B1ECDA6A9D8E284677A52FD3B837D9E25A7C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### NII Open Domain S/MIME CA

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain S/MIME CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B107E40EAE9DCF
- SHA-256: D8DF7E1183D6DEF561D84D56E621A6F36A065DC717F3959BB3BAFC824556D48C
- SPKI SHA-256: 17D4E405EF3CCDC44A911B04A8B13A27187137E6ECC3784329530B5039F6CB53
- Validity: 2016-12-21 to 2026-12-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/sppca/nii/odca3/index.html, https://repo1.secomtrust.net/spcpp/cps/index.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:07:e4:0e:ae:9d:cf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 21 06:38:33 2016 GMT
            Not After : Dec 21 06:38:33 2026 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain S/MIME CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F3:30:D2:3A:C2:18:D8:BC:3F:F7:2B:5E:2D:34:60:C0:A7:5F:4F:B2
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D8DF7E1183D6DEF561D84D56E621A6F36A065DC717F3959BB3BAFC824556D48C
    SPKI SHA256: 17D4E405EF3CCDC44A911B04A8B13A27187137E6ECC3784329530B5039F6CB53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### NII Open Domain S/MIME CA

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, commonName=NII Open Domain S/MIME CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18E0EC7D0F2750AE5F903BF6A31
- SHA-256: 0ADD4B7AEE8E2F4C74DBBEAA0A505EE95ECB3A5D13857C968E92B3A1FC73A07F
- SPKI SHA-256: 17D4E405EF3CCDC44A911B04A8B13A27187137E6ECC3784329530B5039F6CB53
- Validity: 2021-07-12 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: National Institute of Informatics
- CP/CPS: https://repo1.secomtrust.net/sppca/nii/odca3/NIIODCA3.pdf, https://repo1.secomtrust.net/spcpp/cps/index.html
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/nii/odca3/fullcrlsmime.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:8e:0e:c7:d0:f2:75:0a:e5:f9:03:bf:6a:31
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 12 07:01:53 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, CN = NII Open Domain S/MIME CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F3:30:D2:3A:C2:18:D8:BC:3F:F7:2B:5E:2D:34:60:C0:A7:5F:4F:B2
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0ADD4B7AEE8E2F4C74DBBEAA0A505EE95ECB3A5D13857C968E92B3A1FC73A07F
    SPKI SHA256: 17D4E405EF3CCDC44A911B04A8B13A27187137E6ECC3784329530B5039F6CB53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### NII Open Domain S/MIME CA - G2

- Subject: countryName=JP, organizationName=National Institute of Informatics, commonName=NII Open Domain S/MIME CA - G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B169E3CD1BCC22
- SHA-256: 10E4EB925284B1DB0CF97BC5ADFA48BB55002BD486E66CC616C7C81E73E33AFB
- SPKI SHA-256: 2D59B6B8D9EAFCD3115F71C31CF5F104EE90B3B427EA54A35D1A46E3E378ED54
- Validity: 2020-03-05 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:69:e3:cd:1b:cc:22
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar  5 01:23:42 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = National Institute of Informatics, CN = NII Open Domain S/MIME CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2A:E0:37:DE:CD:9D:A8:A0:13:BE:F7:04:10:65:27:83:2B:9E:91:6C
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 10E4EB925284B1DB0CF97BC5ADFA48BB55002BD486E66CC616C7C81E73E33AFB
    SPKI SHA256: 2D59B6B8D9EAFCD3115F71C31CF5F104EE90B3B427EA54A35D1A46E3E378ED54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Osaka University Public RootCA

- Subject: countryName=JP, stateOrProvinceName=Osaka, localityName=Ibaraki, organizationName=Osaka University, commonName=Osaka University Public RootCA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0D1
- SHA-256: 2F76ECED291A754F16CAEA4E0D949506967884871565F2A71000C869DA1315DE
- SPKI SHA-256: 049898A94C6EF6D70618A94C794C15A874734AD000A9B779577A0F146E064076
- Validity: 2010-07-30 to 2020-07-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159313 (0x12b9b0d1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jul 30 05:46:30 2010 GMT
            Not After : Jul 30 05:46:30 2020 GMT
        Subject: C = JP, ST = Osaka, L = Ibaraki, O = Osaka University, CN = Osaka University Public RootCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E3:33:79:BD:3E:DB:E6:3C:B3:18:B0:D3:E7:6A:14:5D:FE:61:FF:73
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2F76ECED291A754F16CAEA4E0D949506967884871565F2A71000C869DA1315DE
    SPKI SHA256: 049898A94C6EF6D70618A94C794C15A874734AD000A9B779577A0F146E064076
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM AATL Time Stamping RSA CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM AATL Time Stamping RSA CA 2024, organizationIdentifier=NTRJP-4011001040781
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Document Signing RSA Root CA 2023, organizationIdentifier=NTRJP-4011001040781
- Serial: 3FF11F918C188B3A905EB52494F28DD0
- SHA-256: E7CE954F6130344A6BC11A3086C3D8211C0F9D3523ABEB8EF7A0FBAB8CA4D557
- SPKI SHA-256: 93DED18CC3E553CF1D5BC0903685982903BBE782F051F28964573DADB91017F2
- Validity: 2024-08-08 to 2044-07-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/ts/aatltsrsaca2024/aatltsrsaca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://docrsarootca2023.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:f1:1f:91:8c:18:8b:3a:90:5e:b5:24:94:f2:8d:d0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Document Signing RSA Root CA 2023, organizationIdentifier = NTRJP-4011001040781
        Validity
            Not Before: Aug  8 06:16:45 2024 GMT
            Not After : Jul 14 00:00:00 2044 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM AATL Time Stamping RSA CA 2024, organizationIdentifier = NTRJP-4011001040781
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                64:D3:06:32:59:F1:19:72:0A:9B:C1:84:8C:E3:96:0B:D6:EC:6B:DB
            X509v3 Authority Key Identifier:
                01:DD:B1:24:30:89:2C:C8:03:83:5E:10:AE:71:1E:49:F2:EE:4B:07
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.10
                  CPS: http://repo1.secomtrust.net/root/docrsa/
            Authority Information Access:
                OCSP - URI:http://docrsarootca2023.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/docrsa/docrsarootca2023.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E7CE954F6130344A6BC11A3086C3D8211C0F9D3523ABEB8EF7A0FBAB8CA4D557
    SPKI SHA256: 93DED18CC3E553CF1D5BC0903685982903BBE782F051F28964573DADB91017F2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.10
- AIA OCSP: http://docrsarootca2023.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/docrsa/docrsarootca2023.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Code Signing CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Code Signing CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0F4
- SHA-256: D5E7AD275AA29FD4D45E7F9D3DFF57EFCCB094F1853B1AA1AD22968CB18B2CC5
- SPKI SHA-256: 9DB97AD838C06CE46C62DCFE8BA094732E956B8067D166FA5DB6C9C9FEE1E6DE
- Validity: 2014-07-23 to 2024-07-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159348 (0x12b9b0f4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jul 23 05:44:00 2014 GMT
            Not After : Jul 23 05:44:00 2024 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                36:F8:37:0C:7D:12:B8:4A:BE:D0:3D:48:B1:86:93:3F:58:B9:8F:D6
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D5E7AD275AA29FD4D45E7F9D3DFF57EFCCB094F1853B1AA1AD22968CB18B2CC5
    SPKI SHA256: 9DB97AD838C06CE46C62DCFE8BA094732E956B8067D166FA5DB6C9C9FEE1E6DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for CodeSigning CA G2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for CodeSigning CA G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 0100004ECD64452CBAA77EE74E33D048
- SHA-256: BB974448A25466F597A55772577FD6C69FDC4D9F8D2B2D8A0232D04E77D52C8C
- SPKI SHA-256: 4298A85ECEE306717D836BAC0C68073FD14E0E4434A67B255DE71B676C2CE959
- Validity: 2021-05-25 to 2031-05-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/codecag2/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.392.200091.100.901.6, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:4e:cd:64:45:2c:ba:a7:7e:e7:4e:33:d0:48
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: May 25 01:37:39 2021 GMT
            Not After : May 25 01:37:39 2031 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for CodeSigning CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                4C:6C:10:EB:25:3A:48:93:C3:5B:BE:3D:B6:8C:FB:9E:FD:B6:4A:65
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.6
                  CPS: http://repository.secomtrust.net/SC-Root3/
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BB974448A25466F597A55772577FD6C69FDC4D9F8D2B2D8A0232D04E77D52C8C
    SPKI SHA256: 4298A85ECEE306717D836BAC0C68073FD14E0E4434A67B255DE71B676C2CE959
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.392.200091.100.901.6, 2.23.140.1.4.1
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for CodeSigning CA G2_SC_RootCA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for CodeSigning CA G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B180E4658AB862062FC7602DB247
- SHA-256: 2A2AC8DE79A38177699A34FA06D3E5FB86C27CDD0CAF3B332C8D861D0A753639
- SPKI SHA-256: 4298A85ECEE306717D836BAC0C68073FD14E0E4434A67B255DE71B676C2CE959
- Validity: 2020-08-06 to 2029-05-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/codecag2/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:80:e4:65:8a:b8:62:06:2f:c7:60:2d:b2:47
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug  6 08:53:55 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for CodeSigning CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                4C:6C:10:EB:25:3A:48:93:C3:5B:BE:3D:B6:8C:FB:9E:FD:B6:4A:65
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                Code Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2A2AC8DE79A38177699A34FA06D3E5FB86C27CDD0CAF3B332C8D861D0A753639
    SPKI SHA256: 4298A85ECEE306717D836BAC0C68073FD14E0E4434A67B255DE71B676C2CE959
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.4.1
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Member PUB CA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B11CCD26B411E685DE82D277F84E
- SHA-256: B9AB1B4AB64EF36EEC3E7B02BE33E474C7026D0D3609E16D212A7C756E241A5E
- SPKI SHA-256: E9C824E936403DC638C8888830083571C1BDFDF8472D15D31555A3EC8AEF0EAE
- Validity: 2021-07-12 to 2023-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca1/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:b9:b1:1c:cd:26:b4:11:e6:85:de:82:d2:77:f8:4e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jul 12 08:02:10 2021 GMT
            Not After : Sep 30 04:20:49 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                47:33:3D:C9:0F:74:79:67:03:A5:7F:FE:76:AE:47:92:5F:40:1E:E5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: http://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B9AB1B4AB64EF36EEC3E7B02BE33E474C7026D0D3609E16D212A7C756E241A5E
    SPKI SHA256: E9C824E936403DC638C8888830083571C1BDFDF8472D15D31555A3EC8AEF0EAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0EC
- SHA-256: 13EA1104449A11A1F81CB97D098C482EC12A2B609EB53C7E6155ED084AA8B093
- SPKI SHA-256: E9C824E936403DC638C8888830083571C1BDFDF8472D15D31555A3EC8AEF0EAE
- Validity: 2013-04-02 to 2023-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159340 (0x12b9b0ec)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Apr  2 05:09:17 2013 GMT
            Not After : Apr  2 05:09:17 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                47:33:3D:C9:0F:74:79:67:03:A5:7F:FE:76:AE:47:92:5F:40:1E:E5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 13EA1104449A11A1F81CB97D098C482EC12A2B609EB53C7E6155ED084AA8B093
    SPKI SHA256: E9C824E936403DC638C8888830083571C1BDFDF8472D15D31555A3EC8AEF0EAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0BD
- SHA-256: 19C1C17D861A85A248A0D4494E52E2EDCC0AA17E335BB0D928143F216B4791A4
- SPKI SHA-256: E9C824E936403DC638C8888830083571C1BDFDF8472D15D31555A3EC8AEF0EAE
- Validity: 2008-05-02 to 2018-05-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159293 (0x12b9b0bd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: May  2 09:19:53 2008 GMT
            Not After : May  2 09:19:53 2018 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                47:33:3D:C9:0F:74:79:67:03:A5:7F:FE:76:AE:47:92:5F:40:1E:E5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 19C1C17D861A85A248A0D4494E52E2EDCC0AA17E335BB0D928143F216B4791A4
    SPKI SHA256: E9C824E936403DC638C8888830083571C1BDFDF8472D15D31555A3EC8AEF0EAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA10

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA10
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B14F188E5176A2
- SHA-256: EE0204E34C0B4D45CC839CF3B9015CEEC946A3661CF2BF10972339426C60E809
- SPKI SHA-256: 5C353300756AE0889A1D0C37412814D5E4710262DF563C204B72C361CE41D51B
- Validity: 2018-08-10 to 2028-08-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:4f:18:8e:51:76:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 10 05:48:01 2018 GMT
            Not After : Aug 10 05:48:01 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA10
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DA:31:F4:F0:4C:BE:61:8A:80:5F:A8:A7:52:50:B1:FB:EF:CD:B0:6E
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                E-mail Protection
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EE0204E34C0B4D45CC839CF3B9015CEEC946A3661CF2BF10972339426C60E809
    SPKI SHA256: 5C353300756AE0889A1D0C37412814D5E4710262DF563C204B72C361CE41D51B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport for Member PUB CA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0EE
- SHA-256: 80E13A2E800847519E023D64F4F9CF20B43CADD1D46BA4811D26ACE31E295FBB
- SPKI SHA-256: DE427FFECACF9FF63490F43EE9AB6AB6526682774895F9999D4C2C2B44B47A98
- Validity: 2013-08-20 to 2023-08-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159342 (0x12b9b0ee)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Aug 20 01:21:11 2013 GMT
            Not After : Aug 20 01:21:11 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2B:70:F9:FC:29:A6:CD:B3:F8:3B:0F:2C:AE:E8:93:ED:F0:3F:16:B5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 80E13A2E800847519E023D64F4F9CF20B43CADD1D46BA4811D26ACE31E295FBB
    SPKI SHA256: DE427FFECACF9FF63490F43EE9AB6AB6526682774895F9999D4C2C2B44B47A98
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B11B81940FADBD311CDD6DEF7D84
- SHA-256: 4F9A6C6D4F8E8824CF2AED17CB01B391EBF1B201BC736CBFB78C59D1086E6C98
- SPKI SHA-256: DE427FFECACF9FF63490F43EE9AB6AB6526682774895F9999D4C2C2B44B47A98
- Validity: 2021-07-12 to 2023-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca2/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:b9:b1:1b:81:94:0f:ad:bd:31:1c:dd:6d:ef:7d:84
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jul 12 07:47:36 2021 GMT
            Not After : Sep 30 04:20:49 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2B:70:F9:FC:29:A6:CD:B3:F8:3B:0F:2C:AE:E8:93:ED:F0:3F:16:B5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: http://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4F9A6C6D4F8E8824CF2AED17CB01B391EBF1B201BC736CBFB78C59D1086E6C98
    SPKI SHA256: DE427FFECACF9FF63490F43EE9AB6AB6526682774895F9999D4C2C2B44B47A98
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0C2
- SHA-256: CE3E771A328CFD7E63E46BAEE01FDEE76D908141537C26542ECD071CBF3F2929
- SPKI SHA-256: DE427FFECACF9FF63490F43EE9AB6AB6526682774895F9999D4C2C2B44B47A98
- Validity: 2008-09-11 to 2018-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ee0fc63f-baa8-47c5-8353-8065ac4afaa5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc14557-e88f-47d7-85ed-33a35a3ce655
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159298 (0x12b9b0c2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Sep 11 09:06:31 2008 GMT
            Not After : Sep 11 09:06:31 2018 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2B:70:F9:FC:29:A6:CD:B3:F8:3B:0F:2C:AE:E8:93:ED:F0:3F:16:B5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CE3E771A328CFD7E63E46BAEE01FDEE76D908141537C26542ECD071CBF3F2929
    SPKI SHA256: DE427FFECACF9FF63490F43EE9AB6AB6526682774895F9999D4C2C2B44B47A98
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA3
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0C6
- SHA-256: 87DB3FCE23CA89D3D0B0C3439798478B1CCF1EC26122D69239140110FE7CF28B
- SPKI SHA-256: 31538E918F824AF8733FD43F97EACA231FBF42DEDFDF20BCA5B4201F4150A574
- Validity: 2009-03-19 to 2019-03-19
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ee0fc63f-baa8-47c5-8353-8065ac4afaa5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc14557-e88f-47d7-85ed-33a35a3ce655
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159302 (0x12b9b0c6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Mar 19 03:04:42 2009 GMT
            Not After : Mar 19 03:04:42 2019 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AC:5C:9A:59:73:AC:FA:24:F8:72:68:45:30:3F:59:87:1B:A9:D4:26
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 87DB3FCE23CA89D3D0B0C3439798478B1CCF1EC26122D69239140110FE7CF28B
    SPKI SHA256: 31538E918F824AF8733FD43F97EACA231FBF42DEDFDF20BCA5B4201F4150A574
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA3
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B11A27E6BE7A4E2AE9197267376F
- SHA-256: FA6EEA08EFF85523E88237579083D340CCCA7D4FC4AA66DED4B3364C7AB98631
- SPKI SHA-256: 31538E918F824AF8733FD43F97EACA231FBF42DEDFDF20BCA5B4201F4150A574
- Validity: 2021-07-12 to 2023-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca3/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:b9:b1:1a:27:e6:be:7a:4e:2a:e9:19:72:67:37:6f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jul 12 07:31:35 2021 GMT
            Not After : Sep 30 04:20:49 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AC:5C:9A:59:73:AC:FA:24:F8:72:68:45:30:3F:59:87:1B:A9:D4:26
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: http://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FA6EEA08EFF85523E88237579083D340CCCA7D4FC4AA66DED4B3364C7AB98631
    SPKI SHA256: 31538E918F824AF8733FD43F97EACA231FBF42DEDFDF20BCA5B4201F4150A574
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA3
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0EF
- SHA-256: 4554C210C751AC8211B6E2046B79F68AFFC8082274AEA489038660620C4182DD
- SPKI SHA-256: 31538E918F824AF8733FD43F97EACA231FBF42DEDFDF20BCA5B4201F4150A574
- Validity: 2013-08-20 to 2023-08-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159343 (0x12b9b0ef)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Aug 20 01:29:56 2013 GMT
            Not After : Aug 20 01:29:56 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AC:5C:9A:59:73:AC:FA:24:F8:72:68:45:30:3F:59:87:1B:A9:D4:26
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4554C210C751AC8211B6E2046B79F68AFFC8082274AEA489038660620C4182DD
    SPKI SHA256: 31538E918F824AF8733FD43F97EACA231FBF42DEDFDF20BCA5B4201F4150A574
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA4

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1575075487009
- SHA-256: B10861737B3EC9B11FA6154D23970FFB2DABFC28AE6A6BF56C3F3204266239AD
- SPKI SHA-256: 7B4525C1A0E4B129E0D0DB2E8502C331D2F71DD44B464F3D0AC93B4092BB5E6E
- Validity: 2018-10-04 to 2028-10-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca4/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:57:50:75:48:70:09
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Oct  4 05:28:09 2018 GMT
            Not After : Oct  4 05:28:09 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                48:8C:65:76:D2:1E:AB:F5:FF:38:24:B6:C4:36:D9:0A:9F:A0:BC:AE
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B10861737B3EC9B11FA6154D23970FFB2DABFC28AE6A6BF56C3F3204266239AD
    SPKI SHA256: 7B4525C1A0E4B129E0D0DB2E8502C331D2F71DD44B464F3D0AC93B4092BB5E6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport for Member PUB CA4_2013-2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0BC
- SHA-256: 0940451DFECB675B5204C8AE07189D4E4E90957CFD2BAFDCFF36DB20C279E91A
- SPKI SHA-256: 7B4525C1A0E4B129E0D0DB2E8502C331D2F71DD44B464F3D0AC93B4092BB5E6E
- Validity: 2013-11-20 to 2023-11-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca4/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594748 (0x22b9b0bc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Nov 20 02:18:46 2013 GMT
            Not After : Nov 20 02:18:46 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                48:8C:65:76:D2:1E:AB:F5:FF:38:24:B6:C4:36:D9:0A:9F:A0:BC:AE
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0940451DFECB675B5204C8AE07189D4E4E90957CFD2BAFDCFF36DB20C279E91A
    SPKI SHA256: 7B4525C1A0E4B129E0D0DB2E8502C331D2F71DD44B464F3D0AC93B4092BB5E6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Member PUB CA5

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B16DA7E6F3BBBA
- SHA-256: 8C6DB8171AE6785F05426AE58C3D36F7559352202E9209B9D29B1BD447961DC8
- SPKI SHA-256: BF787947FDCECCC0BE3415CA8F4E6FE0B406E65685CC4F5F0782AC1A9C0032D9
- Validity: 2020-05-20 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca5/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:6d:a7:e6:f3:bb:ba
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: May 20 07:10:35 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                89:39:41:64:91:E9:46:A4:16:59:07:F2:2B:AF:52:7F:7D:4B:DA:92
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C6DB8171AE6785F05426AE58C3D36F7559352202E9209B9D29B1BD447961DC8
    SPKI SHA256: BF787947FDCECCC0BE3415CA8F4E6FE0B406E65685CC4F5F0782AC1A9C0032D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Member PUB CA5_2015-2025

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA5
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0E1D2496D57C4
- SHA-256: C931A0F85A052901234A54FD460D417F1A8B63C38C4811F79B98F3AE1C2FE9FB
- SPKI SHA-256: BF787947FDCECCC0BE3415CA8F4E6FE0B406E65685CC4F5F0782AC1A9C0032D9
- Validity: 2015-08-12 to 2025-08-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca5/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:e1:d2:49:6d:57:c4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 12 04:48:29 2015 GMT
            Not After : Aug 12 04:48:29 2025 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                89:39:41:64:91:E9:46:A4:16:59:07:F2:2B:AF:52:7F:7D:4B:DA:92
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C931A0F85A052901234A54FD460D417F1A8B63C38C4811F79B98F3AE1C2FE9FB
    SPKI SHA256: BF787947FDCECCC0BE3415CA8F4E6FE0B406E65685CC4F5F0782AC1A9C0032D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Member PUB CA6

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0ED768D70EDCE
- SHA-256: C76C08D7E218274C7DDACB4ED15C73506B7942F3851F187E5DFA47F25EA957D5
- SPKI SHA-256: 367BC97D7854E33F78D9EC3FCD69C84CD55ED7676AF8A08585C2E7E21A3483C7
- Validity: 2015-12-22 to 2025-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9422ccb2-25df-4259-b7f3-2de92f3c26dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=673ba97e-1533-4d56-9acb-a10a48cae575
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:ed:76:8d:70:ed:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 22 04:48:25 2015 GMT
            Not After : Dec 22 04:48:25 2025 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D2:33:C5:68:6D:15:50:BA:4B:4B:7E:F4:5A:29:F5:91:DF:F9:A9:2D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C76C08D7E218274C7DDACB4ED15C73506B7942F3851F187E5DFA47F25EA957D5
    SPKI SHA256: 367BC97D7854E33F78D9EC3FCD69C84CD55ED7676AF8A08585C2E7E21A3483C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Member PUB CA7

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA7
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18CA7598FE1D7178D0169AC380F
- SHA-256: BA08827159A8510FDF274383DCC44E70423416DF862B972F8945AAF49E30D5A4
- SPKI SHA-256: 2BFED377075FA99810A9712FB22A6929EF39ED614827BFA21A562061D1E8D1CF
- Validity: 2021-07-12 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/CA7/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:8c:a7:59:8f:e1:d7:17:8d:01:69:ac:38:0f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 12 06:32:24 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA7
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BD:08:5E:25:84:9C:FD:35:24:D8:1D:C7:30:6C:78:9D:C1:A4:BB:20
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BA08827159A8510FDF274383DCC44E70423416DF862B972F8945AAF49E30D5A4
    SPKI SHA256: 2BFED377075FA99810A9712FB22A6929EF39ED614827BFA21A562061D1E8D1CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport for Member PUB CA7

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA7
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B10F162A7471D7
- SHA-256: 9BDFB383F96B0A4B54B5D6C1C4CC1EA20582B9BEC2BBC633904CDE87EEAEDBD1
- SPKI SHA-256: 2BFED377075FA99810A9712FB22A6929EF39ED614827BFA21A562061D1E8D1CF
- Validity: 2017-03-24 to 2027-03-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca7/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:0f:16:2a:74:71:d7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 24 06:30:31 2017 GMT
            Not After : Mar 24 06:30:31 2027 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA7
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BD:08:5E:25:84:9C:FD:35:24:D8:1D:C7:30:6C:78:9D:C1:A4:BB:20
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9BDFB383F96B0A4B54B5D6C1C4CC1EA20582B9BEC2BBC633904CDE87EEAEDBD1
    SPKI SHA256: 2BFED377075FA99810A9712FB22A6929EF39ED614827BFA21A562061D1E8D1CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- expires_within_398_days

### SECOM Passport for Member PUB CA8

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CA8
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B12B288A041897
- SHA-256: 7A4FCBA079F5BDDCF0A76C3B03A377E155A53009474A1B3EB8F34961A53BDA9C
- SPKI SHA-256: 927587A0C16B1290D8707FDB72CFE6882C5E381F940D9D0E77D279DE1720153A
- Validity: 2018-01-09 to 2028-01-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/ca8/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:2b:28:8a:04:18:97
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jan  9 06:01:29 2018 GMT
            Not After : Jan  9 06:01:29 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CA8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                76:2B:D9:8D:CC:35:36:32:45:05:DF:9E:8C:6A:17:D1:33:DC:03:07
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7A4FCBA079F5BDDCF0A76C3B03A377E155A53009474A1B3EB8F34961A53BDA9C
    SPKI SHA256: 927587A0C16B1290D8707FDB72CFE6882C5E381F940D9D0E77D279DE1720153A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport for Member PUB CodeSigning CA G1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CodeSigning CA G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B16F96784D3824
- SHA-256: 305A915AD4A71F4850A5B8FBB139907C885C8C6AE89985F267FEC0A3E0D72BCD
- SPKI SHA-256: B2F5D9FE8AFD232AB5205BD084F7AC22DD55D768679FA126BECC64BB5CE74C84
- Validity: 2020-07-08 to 2029-05-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:6f:96:78:4d:38:24
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul  8 07:55:26 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CodeSigning CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CF:A4:C1:FD:BD:3C:E3:3C:38:31:8A:20:F8:41:CA:A2:E6:9C:7D:29
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                Code Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 305A915AD4A71F4850A5B8FBB139907C885C8C6AE89985F267FEC0A3E0D72BCD
    SPKI SHA256: B2F5D9FE8AFD232AB5205BD084F7AC22DD55D768679FA126BECC64BB5CE74C84
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.4.1
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Member PUB CodeSigning CA G1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=SECOM Passport for Member 2.0 PUB, commonName=SECOM Passport for Member PUB CodeSigning CA G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B167395270F3D6
- SHA-256: CAC05F4F05081099326DCF27C4D970A8A3EA914E6792ADACC1049611C9ED43BA
- SPKI SHA-256: B2F5D9FE8AFD232AB5205BD084F7AC22DD55D768679FA126BECC64BB5CE74C84
- Validity: 2020-02-21 to 2029-05-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfm20pub/PfM20PUB-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9422ccb2-25df-4259-b7f3-2de92f3c26dd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=673ba97e-1533-4d56-9acb-a10a48cae575
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:67:39:52:70:f3:d6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Feb 21 07:45:53 2020 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = SECOM Passport for Member 2.0 PUB, CN = SECOM Passport for Member PUB CodeSigning CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CF:A4:C1:FD:BD:3C:E3:3C:38:31:8A:20:F8:41:CA:A2:E6:9C:7D:29
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                Code Signing, OCSP Signing
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CAC05F4F05081099326DCF27C4D970A8A3EA914E6792ADACC1049611C9ED43BA
    SPKI SHA256: B2F5D9FE8AFD232AB5205BD084F7AC22DD55D768679FA126BECC64BB5CE74C84
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing, OCSP Signing
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.4.1
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ocsp_id_pkix_ocsp_nocheck_ext_not_included_server_auth: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for PublicID AATL RSA CA 2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID AATL RSA CA 2023, organizationIdentifier=NTRJP-4011001040781
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Document Signing RSA Root CA 2023, organizationIdentifier=NTRJP-4011001040781
- Serial: 010000065E566F5039F9576061C0FD6F
- SHA-256: D2A60B7C6DFE267AD055DA26BF68D9F1478D862310F3DD0A73325941C2F00DDE
- SPKI SHA-256: 2B60B4BFD87CB59C54800A2B48B2EAC95BBDB65218942A4ED374E4E9F714AED3
- Validity: 2023-02-24 to 2043-02-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/aatlrsaca2023/aatlrsaca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://docrsarootca2023.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:06:5e:56:6f:50:39:f9:57:60:61:c0:fd:6f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Document Signing RSA Root CA 2023, organizationIdentifier = NTRJP-4011001040781
        Validity
            Not Before: Feb 24 07:41:36 2023 GMT
            Not After : Feb  1 00:00:00 2043 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for PublicID AATL RSA CA 2023, organizationIdentifier = NTRJP-4011001040781
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                3F:A0:9E:6D:34:FF:F3:A5:A1:08:DD:D7:77:25:4A:F6:48:1F:31:E4
            X509v3 Authority Key Identifier:
                01:DD:B1:24:30:89:2C:C8:03:83:5E:10:AE:71:1E:49:F2:EE:4B:07
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.10
                  CPS: http://repo1.secomtrust.net/root/docrsa/
            Authority Information Access:
                OCSP - URI:http://docrsarootca2023.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/docrsa/docrsarootca2023.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D2A60B7C6DFE267AD055DA26BF68D9F1478D862310F3DD0A73325941C2F00DDE
    SPKI SHA256: 2B60B4BFD87CB59C54800A2B48B2EAC95BBDB65218942A4ED374E4E9F714AED3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.10
- AIA OCSP: http://docrsarootca2023.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/docrsa/docrsarootca2023.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/docrsa/docrsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for PublicID Document Signing RSA CA 2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID Document Signing RSA CA 2023
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM RSA Root CA 2023
- Serial: 010000041C223AF622A83408EB6D397D
- SHA-256: 368A62B89C9713662E409AB7DF722525D6B226551B518F960559EE1DF0FFA16E
- SPKI SHA-256: 71FA22E77E2F6D33EE92C139476940E268E73E8888FD803B1794DB31EE0567ED
- Validity: 2023-02-24 to 2043-02-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/docrsaca2023/docrsaca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.2.392.200091.100.901.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://rsarootca2023.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:04:1c:22:3a:f6:22:a8:34:08:eb:6d:39:7d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM RSA Root CA 2023
        Validity
            Not Before: Feb 24 06:53:38 2023 GMT
            Not After : Feb  1 00:00:00 2043 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for PublicID Document Signing RSA CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                B7:21:66:C2:55:45:E7:93:4E:A2:C8:AD:5D:B4:06:32:42:CE:E1:D9
            X509v3 Authority Key Identifier:
                51:33:6A:2A:EF:DB:1F:80:ED:B2:C6:D3:06:D2:25:93:C4:C8:B6:66
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.9
                  CPS: http://repo1.secomtrust.net/root/rsa/
            Authority Information Access:
                OCSP - URI:http://rsarootca2023.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/rsa/rsarootca2023.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 368A62B89C9713662E409AB7DF722525D6B226551B518F960559EE1DF0FFA16E
    SPKI SHA256: 71FA22E77E2F6D33EE92C139476940E268E73E8888FD803B1794DB31EE0567ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.2.392.200091.100.901.9
- AIA OCSP: http://rsarootca2023.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/rsa/rsarootca2023.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for PublicID SMIME RSA CA 2023

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID SMIME RSA CA 2023
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B19AF3380D8F037998731AA1D930
- SHA-256: DB088F140ACBE85FA1EC83D3851063803FFD8471564CF852B92A60FEB965A02F
- SPKI SHA-256: D6A44258AD67C987B7C4D23E6A76C52175C7CE573AB2009C13382E03EB63C6F0
- Validity: 2023-06-07 to 2029-05-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/smimersaca2023/smimersaca2023.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.5.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:9a:f3:38:0d:8f:03:79:98:73:1a:a1:d9:30
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jun  7 04:33:22 2023 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for PublicID SMIME RSA CA 2023
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                01:36:A8:AB:68:C0:C6:98:FA:99:6C:C6:A4:FA:92:A8:37:14:E2:D2
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
                Policy: 2.23.140.1.5.1.3
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DB088F140ACBE85FA1EC83D3851063803FFD8471564CF852B92A60FEB965A02F
    SPKI SHA256: D6A44258AD67C987B7C4D23E6A76C52175C7CE573AB2009C13382E03EB63C6F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.392.200091.100.901.4, 2.23.140.1.5.1.3
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for PublicID SMIME RSA CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for PublicID SMIME RSA CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM SMIME RSA Root CA 2024
- Serial: 41467AC900BDEF5CB0861AEE669A51A0
- SHA-256: 1904D2D9AC640920A9E74FBB0924E4577381D738B10373E2F255049B1DEBC63B
- SPKI SHA-256: DE92C803FCCF44FC59932E8D5ACBC6E5B2AC4455D2DBBE4E83CFCD7A784165D0
- Validity: 2024-05-16 to 2042-01-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfm20pub/smimersaca2024/smimersaca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.3, 1.2.392.200091.100.901.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://smimersarootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/smimersa/smimersarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:46:7a:c9:00:bd:ef:5c:b0:86:1a:ee:66:9a:51:a0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM SMIME RSA Root CA 2024
        Validity
            Not Before: May 16 06:05:06 2024 GMT
            Not After : Jan 15 00:00:00 2042 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for PublicID SMIME RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7B:E1:9C:A8:36:1C:47:A4:04:FB:01:82:6F:BA:71:41:35:1C:30:B0
            X509v3 Subject Key Identifier:
                4F:BF:06:6A:57:DF:CC:22:5F:3A:B2:2C:28:55:A1:F1:FF:EA:79:62
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.3
                Policy: 1.2.392.200091.100.901.12
                  CPS: http://repo1.secomtrust.net/root/smimersa/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/smimersa/smimersarootca2024.crl
            Authority Information Access:
                OCSP - URI:http://smimersarootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/smimersa/smimersarootca2024.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1904D2D9AC640920A9E74FBB0924E4577381D738B10373E2F255049B1DEBC63B
    SPKI SHA256: DE92C803FCCF44FC59932E8D5ACBC6E5B2AC4455D2DBBE4E83CFCD7A784165D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.3, 1.2.392.200091.100.901.12
- AIA OCSP: http://smimersarootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/smimersa/smimersarootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/smimersa/smimersarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Web EV 2.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV 2.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0C6
- SHA-256: 5ED950156684A63B726383A9908719D93163B9984C3C8629221F0613B6518140
- SPKI SHA-256: 59AD858E555F18AC2F9221F42D85A1FB2FA284795A4E6550FA0A9912C4774706
- Validity: 2014-09-03 to 2024-09-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594758 (0x22b9b0c6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep  3 04:39:52 2014 GMT
            Not After : Sep  3 04:39:52 2024 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web EV 2.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                16:4B:FB:0C:97:38:8A:18:5A:54:A1:46:CF:89:24:47:CC:C4:76:B3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5ED950156684A63B726383A9908719D93163B9984C3C8629221F0613B6518140
    SPKI SHA256: 59AD858E555F18AC2F9221F42D85A1FB2FA284795A4E6550FA0A9912C4774706
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Web EV 2.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV 2.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B19D60F2A361D7FA7E957C63BD5C
- SHA-256: 39B6E3B388F749521DF2B354182EB4CD87D4BF36439BFAF0202E5596CFC2CAA4
- SPKI SHA-256: 59AD858E555F18AC2F9221F42D85A1FB2FA284795A4E6550FA0A9912C4774706
- Validity: 2023-08-30 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:9d:60:f2:a3:61:d7:fa:7e:95:7c:63:bd:5c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 30 04:35:47 2023 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web EV 2.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                16:4B:FB:0C:97:38:8A:18:5A:54:A1:46:CF:89:24:47:CC:C4:76:B3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 39B6E3B388F749521DF2B354182EB4CD87D4BF36439BFAF0202E5596CFC2CAA4
    SPKI SHA256: 59AD858E555F18AC2F9221F42D85A1FB2FA284795A4E6550FA0A9912C4774706
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport for Web EV 2.0 CA_2014-2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV 2.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0C9
- SHA-256: E1F2E95000F815E11C81490430B5D02C8D81D0D256C85DF68B516D6C27761926
- SPKI SHA-256: 59AD858E555F18AC2F9221F42D85A1FB2FA284795A4E6550FA0A9912C4774706
- Validity: 2014-12-16 to 2024-12-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems Co., Ltd.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/fullcrl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594761 (0x22b9b0c9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 16 07:04:09 2014 GMT
            Not After : Dec 16 07:04:09 2024 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web EV 2.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                16:4B:FB:0C:97:38:8A:18:5A:54:A1:46:CF:89:24:47:CC:C4:76:B3
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E1F2E95000F815E11C81490430B5D02C8D81D0D256C85DF68B516D6C27761926
    SPKI SHA256: 59AD858E555F18AC2F9221F42D85A1FB2FA284795A4E6550FA0A9912C4774706
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Web EV CA_2007-2017

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1
- Serial: 1033C4D6
- SHA-256: 409C310B2B9E6D097D70228F6EB40C255BF2BB861A03DE9D990919F8EAFFE244
- SPKI SHA-256: 89B17C070055990A43ECF20151A150949852EF98A0554057A934E44404B6CA6E
- Validity: 2007-06-14 to 2017-06-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwevca/, https://repo1.secomtrust.net/spcpp/pfw/pfwevca/
- CP/CPS same as parent: true
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2105&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/EV-Root1/EVRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 271828182 (0x1033c4d6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication EV RootCA1
        Validity
            Not Before: Jun 14 12:23:27 2007 GMT
            Not After : Jun 14 12:23:27 2017 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                96:F1:92:44:E1:49:7B:21:FE:50:6A:3A:61:B7:0C:61:B8:09:D7:34
            X509v3 Authority Key Identifier:
                35:4A:F5:4D:AF:3F:D7:82:38:AC:AB:71:65:17:75:8C:9D:55:93:E6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/EV-Root1/EVRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/EV-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 409C310B2B9E6D097D70228F6EB40C255BF2BB861A03DE9D990919F8EAFFE244
    SPKI SHA256: 89B17C070055990A43ECF20151A150949852EF98A0554057A934E44404B6CA6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/EV-Root1/EVRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Web EV CA_2012-2022

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web EV CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1
- Serial: 1033C4D7
- SHA-256: CBE221580A9800B7E4608D21F7D59E539A64D5C3996C722CF2CDE908AA89D4BA
- SPKI SHA-256: 89B17C070055990A43ECF20151A150949852EF98A0554057A934E44404B6CA6E
- Validity: 2012-11-13 to 2022-11-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwevca/, https://repo1.secomtrust.net/spcpp/pfw/pfwevca/
- CP/CPS same as parent: true
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2105&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://evroot.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/EV-Root1/EVRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 271828183 (0x1033c4d7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication EV RootCA1
        Validity
            Not Before: Nov 13 05:54:09 2012 GMT
            Not After : Nov 13 05:54:09 2022 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web EV CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                96:F1:92:44:E1:49:7B:21:FE:50:6A:3A:61:B7:0C:61:B8:09:D7:34
            X509v3 Authority Key Identifier:
                35:4A:F5:4D:AF:3F:D7:82:38:AC:AB:71:65:17:75:8C:9D:55:93:E6
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/EV-Root1/EVRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/EV-Root1/
            Authority Information Access:
                OCSP - URI:http://evroot.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CBE221580A9800B7E4608D21F7D59E539A64D5C3996C722CF2CDE908AA89D4BA
    SPKI SHA256: 89B17C070055990A43ECF20151A150949852EF98A0554057A934E44404B6CA6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://evroot.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/EV-Root1/EVRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Web EV ECC CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web EV ECC CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024
- Serial: 4FE6B3F069C4A8C79B6BE415245EB4EE
- SHA-256: 0930324B3D817D306B6E01C6205B56A3AC856142FD5AAE166EF65160660DEE5C
- SPKI SHA-256: FE7719DC7A2EBCB46D36DE591430DC1F014F53F998076906848A912E27EFE87C
- Validity: 2024-05-16 to 2039-01-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/eveccca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://tlseccrootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:e6:b3:f0:69:c4:a8:c7:9b:6b:e4:15:24:5e:b4:ee
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS ECC Root CA 2024
        Validity
            Not Before: May 16 05:41:08 2024 GMT
            Not After : Jan 12 00:00:00 2039 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for Web EV ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
            X509v3 Subject Key Identifier:
                58:BF:80:66:0F:F0:3A:47:21:29:1B:47:F3:24:EA:1A:C7:06:3B:AE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repo1.secomtrust.net/root/tlsecc/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlseccrootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsecc/tlseccrootca2024.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0930324B3D817D306B6E01C6205B56A3AC856142FD5AAE166EF65160660DEE5C
    SPKI SHA256: FE7719DC7A2EBCB46D36DE591430DC1F014F53F998076906848A912E27EFE87C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://tlseccrootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsecc/tlseccrootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Web EV RSA CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web EV RSA CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Serial: 47A59120CF930432DF6E4126CCFFF684
- SHA-256: 3E2464D4562FB4410F20C5C66C812C52BFBBEF31059CE55EF5BDB3703386AA74
- SPKI SHA-256: 99BF4F216493DAA0AD20F152C83B9602822977C9170BCD9EE94A7EA02FDD3041
- Validity: 2024-05-16 to 2039-01-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwev2ca/evrsaca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:a5:91:20:cf:93:04:32:df:6e:41:26:cc:ff:f6:84
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Validity
            Not Before: May 16 05:01:37 2024 GMT
            Not After : Jan 12 00:00:00 2039 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for Web EV RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Subject Key Identifier:
                BD:AA:9E:64:9A:3D:F0:8A:E1:67:9C:DF:36:2A:28:19:7C:7E:79:96
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repo1.secomtrust.net/root/tlsrsa/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlsrsarootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3E2464D4562FB4410F20C5C66C812C52BFBBEF31059CE55EF5BDB3703386AA74
    SPKI SHA256: 99BF4F216493DAA0AD20F152C83B9602822977C9170BCD9EE94A7EA02FDD3041
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Web MH CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web MH CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B14DC876184E0C
- SHA-256: 4E62A252592F9D71FFE2037757F855D4A0235D6638BD105E9EF17086CE2BBC25
- SPKI SHA-256: ABD23EAFE58F5F87FA16C0DFB5B920160948481409B5FE43AADF215C73DAEFE5
- Validity: 2018-07-31 to 2028-07-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwmhca/PfWMHCA-CP2.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwmhca/fullcrl2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:4d:c8:76:18:4e:0c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 31 05:46:12 2018 GMT
            Not After : Jul 31 05:46:12 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web MH CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                33:95:FD:B1:72:F1:E6:50:32:2D:59:52:FB:A7:5A:F1:05:01:C9:0A
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4E62A252592F9D71FFE2037757F855D4A0235D6638BD105E9EF17086CE2BBC25
    SPKI SHA256: ABD23EAFE58F5F87FA16C0DFB5B920160948481409B5FE43AADF215C73DAEFE5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport for Web MH CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web MH CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0EEDAE6CEE513
- SHA-256: 3C46B8AF40EB82A3A330D8C5BD07E1CB616B46B1D701179E025B3E6866E3C89E
- SPKI SHA-256: F961CDAC5757E0BD17CAE42C5BB277EB8C11A20DD4536D3699356F2C081FD3E4
- Validity: 2015-12-30 to 2025-12-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwmhca/fullcrl2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:ee:da:e6:ce:e5:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec 30 05:04:08 2015 GMT
            Not After : Dec 30 05:04:08 2025 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web MH CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                20:04:51:36:1D:CB:D1:2F:79:89:AD:8B:C9:B2:DE:FA:EB:95:2A:4D
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3C46B8AF40EB82A3A330D8C5BD07E1CB616B46B1D701179E025B3E6866E3C89E
    SPKI SHA256: F961CDAC5757E0BD17CAE42C5BB277EB8C11A20DD4536D3699356F2C081FD3E4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Web OV ECC CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web OV ECC CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024
- Serial: 4FE6B3EF9CA8877E2819160426B614B4
- SHA-256: 42F56E96CD88B13C29258FCDC1213040ABF0C42EA29672991AEC3F3734CED056
- SPKI SHA-256: 29A2E885B7F150511F8F800087766A672D4E3BCC3A961725A134D46C3950D7FF
- Validity: 2024-05-16 to 2039-01-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/oveccca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.902.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tlseccrootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:e6:b3:ef:9c:a8:87:7e:28:19:16:04:26:b6:14:b4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS ECC Root CA 2024
        Validity
            Not Before: May 16 05:26:53 2024 GMT
            Not After : Jan 12 00:00:00 2039 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for Web OV ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
            X509v3 Subject Key Identifier:
                F1:C1:24:80:B4:07:DB:AE:F9:5E:CE:1C:F4:33:07:E3:ED:FF:B7:B8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.902.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlseccrootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsecc/tlseccrootca2024.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 42F56E96CD88B13C29258FCDC1213040ABF0C42EA29672991AEC3F3734CED056
    SPKI SHA256: 29A2E885B7F150511F8F800087766A672D4E3BCC3A961725A134D46C3950D7FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.902.3
- AIA OCSP: http://tlseccrootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsecc/tlseccrootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Web OV RSA CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM Passport for Web OV RSA CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Serial: 47A5911F0A7CBD021A9E99CFEA57A194
- SHA-256: 3520ABFC5A4C2558C89BF90EE29181D19518CCA6D0A57A6DC568F4F07C89F8DD
- SPKI SHA-256: 30FCE7399732883999A5F378A6DA7911273A2F98F84130D07C3C25B608F06A18
- Validity: 2024-05-16 to 2039-01-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/ovrsaca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.11
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:a5:91:1f:0a:7c:bd:02:1a:9e:99:cf:ea:57:a1:94
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Validity
            Not Before: May 16 04:44:08 2024 GMT
            Not After : Jan 12 00:00:00 2039 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM Passport for Web OV RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Subject Key Identifier:
                35:9B:C5:79:86:0B:22:F8:F9:E4:36:B9:E1:F4:28:7A:57:8A:84:82
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.901.11
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
            Authority Information Access:
                OCSP - URI:http://tlsrsarootca2024.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3520ABFC5A4C2558C89BF90EE29181D19518CCA6D0A57A6DC568F4F07C89F8DD
    SPKI SHA256: 30FCE7399732883999A5F378A6DA7911273A2F98F84130D07C3C25B608F06A18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.11
- AIA OCSP: http://tlsrsarootca2024.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/tlsrsa/tlsrsarootca2024.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Web SR 2.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 2.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E2
- SHA-256: 2297570DBD2C0DEF1B050D9927FEA895DB0FD20B82B8596E0A0A1325ECE08D05
- SPKI SHA-256: D02CDD2BF1842D39ED1320F8B9BF5BDDFD1C3AC84990AA5280B6ECEE8F5C1DB0
- Validity: 2012-02-17 to 2022-02-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159330 (0x12b9b0e2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Feb 17 04:49:28 2012 GMT
            Not After : Feb 17 04:49:28 2022 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 2.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                30:9A:00:57:99:44:63:6B:C9:B2:F2:3D:8D:83:6B:3B:D7:9D:EF:64
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2297570DBD2C0DEF1B050D9927FEA895DB0FD20B82B8596E0A0A1325ECE08D05
    SPKI SHA256: D02CDD2BF1842D39ED1320F8B9BF5BDDFD1C3AC84990AA5280B6ECEE8F5C1DB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Web SR 2.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 2.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0BC
- SHA-256: 20B4D757C2CAF12720129ED52AB2F7D6139C4F7674825719CBC920FA185E17AC
- SPKI SHA-256: D02CDD2BF1842D39ED1320F8B9BF5BDDFD1C3AC84990AA5280B6ECEE8F5C1DB0
- Validity: 2008-02-28 to 2018-02-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwsr2ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr2ca/
- CP/CPS same as parent: true
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2105&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159292 (0x12b9b0bc)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Feb 28 08:51:17 2008 GMT
            Not After : Feb 28 08:51:17 2018 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 2.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                30:9A:00:57:99:44:63:6B:C9:B2:F2:3D:8D:83:6B:3B:D7:9D:EF:64
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 20B4D757C2CAF12720129ED52AB2F7D6139C4F7674825719CBC920FA185E17AC
    SPKI SHA256: D02CDD2BF1842D39ED1320F8B9BF5BDDFD1C3AC84990AA5280B6ECEE8F5C1DB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Web SR 2.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 2.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E5
- SHA-256: BD5639756F0D837D99A210672A210C649B23EA59B4FA76DE0D6E42FD7BAD21B9
- SPKI SHA-256: D02CDD2BF1842D39ED1320F8B9BF5BDDFD1C3AC84990AA5280B6ECEE8F5C1DB0
- Validity: 2012-11-13 to 2022-11-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159333 (0x12b9b0e5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Nov 13 05:11:09 2012 GMT
            Not After : Nov 13 05:11:09 2022 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 2.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                30:9A:00:57:99:44:63:6B:C9:B2:F2:3D:8D:83:6B:3B:D7:9D:EF:64
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BD5639756F0D837D99A210672A210C649B23EA59B4FA76DE0D6E42FD7BAD21B9
    SPKI SHA256: D02CDD2BF1842D39ED1320F8B9BF5BDDFD1C3AC84990AA5280B6ECEE8F5C1DB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Web SR 3.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0BD
- SHA-256: C8C3FF5DE98EF3692F3A1968A13EBD2A860BB3F486EC45434F8E9073C4A9CD67
- SPKI SHA-256: F87678DB3FBA8F36DFADFFBCCE807EAE1856A3C95693D50C36584FB1E894A49B
- Validity: 2013-12-06 to 2023-12-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594749 (0x22b9b0bd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Dec  6 04:37:14 2013 GMT
            Not After : Dec  6 04:37:14 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 3.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C7:8C:C6:0E:E6:00:AF:74:B9:65:3A:FC:26:09:E5:13:03:C6:D8:2F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8C3FF5DE98EF3692F3A1968A13EBD2A860BB3F486EC45434F8E9073C4A9CD67
    SPKI SHA256: F87678DB3FBA8F36DFADFFBCCE807EAE1856A3C95693D50C36584FB1E894A49B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM Passport for Web SR 3.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1AB809E203849C8A79FA9A4C417
- SHA-256: 59F8A94C11BCD19FD4E0F1AC4D394E37913AE5FB5862A25A8ECD167BA3B9A3A2
- SPKI SHA-256: 461723D1D71D3A8BC849E30F5D35A9B940E235FD44CF2C521DE3142B495FA11F
- Validity: 2025-04-09 to 2028-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/fullcrl2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:ab:80:9e:20:38:49:c8:a7:9f:a9:a4:c4:17
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr  9 05:08:22 2025 GMT
            Not After : Mar 16 05:49:12 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 3.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CB:EF:3D:EF:83:74:A1:A8:42:F0:3B:40:36:FA:6D:82:94:A9:27:36
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.392.200091.100.901.4
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 59F8A94C11BCD19FD4E0F1AC4D394E37913AE5FB5862A25A8ECD167BA3B9A3A2
    SPKI SHA256: 461723D1D71D3A8BC849E30F5D35A9B940E235FD44CF2C521DE3142B495FA11F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM Passport for Web SR 3.0 CA

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0C7
- SHA-256: 91BCE7544146908AB4BCF9DFF7F98067655A69B0C642E117A031CD22C7C9A0EE
- SPKI SHA-256: F87678DB3FBA8F36DFADFFBCCE807EAE1856A3C95693D50C36584FB1E894A49B
- Validity: 2014-09-03 to 2024-09-03
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/PfWSRCA-CP.pdf, https://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594759 (0x22b9b0c7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Sep  3 04:47:25 2014 GMT
            Not After : Sep  3 04:47:25 2024 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 3.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C7:8C:C6:0E:E6:00:AF:74:B9:65:3A:FC:26:09:E5:13:03:C6:D8:2F
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 91BCE7544146908AB4BCF9DFF7F98067655A69B0C642E117A031CD22C7C9A0EE
    SPKI SHA256: F87678DB3FBA8F36DFADFFBCCE807EAE1856A3C95693D50C36584FB1E894A49B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM Passport for Web SR 3.0 CA_2018-2028

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport for Web SR 3.0 CA
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B12F4D05F9ED13
- SHA-256: E05ED4A9E4C773308A93E849861225AE349A92BBD4BACDD4900AD4E73B131100
- SPKI SHA-256: 461723D1D71D3A8BC849E30F5D35A9B940E235FD44CF2C521DE3142B495FA11F
- Validity: 2018-03-16 to 2028-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/pfw/pfwsr3ca/fullcrl2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:2f:4d:05:f9:ed:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 16 05:49:12 2018 GMT
            Not After : Mar 16 05:49:12 2028 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport for Web SR 3.0 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CB:EF:3D:EF:83:74:A1:A8:42:F0:3B:40:36:FA:6D:82:94:A9:27:36
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E05ED4A9E4C773308A93E849861225AE349A92BBD4BACDD4900AD4E73B131100
    SPKI SHA256: 461723D1D71D3A8BC849E30F5D35A9B940E235FD44CF2C521DE3142B495FA11F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM Passport Plus CA1 G1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM Passport Plus CA1 G1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B195B8C28D6DBF2EB521778D8C42
- SHA-256: C798C9CD2324778FE3B20657B0A267D44EAAD6987FFB60A284A7A7C9B3CAAE0F
- SPKI SHA-256: 5DC83862EE9E52CC594D85A3C1939A02F9998462BE6AB1005B4D6FF7F372E6A0
- Validity: 2022-04-15 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/spcpp/plus/plus-cp-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/plus/ca1g1/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:95:b8:c2:8d:6d:bf:2e:b5:21:77:8d:8c:42
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr 15 07:08:53 2022 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM Passport Plus CA1 G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2F:CF:31:81:07:15:97:C8:C4:3B:CF:C7:5F:DC:6F:87:BF:8A:2A:71
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C798C9CD2324778FE3B20657B0A267D44EAAD6987FFB60A284A7A7C9B3CAAE0F
    SPKI SHA256: 5DC83862EE9E52CC594D85A3C1939A02F9998462BE6AB1005B4D6FF7F372E6A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM SMIME RSA Root CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM SMIME RSA Root CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1AE8DD083083E82F8A3CD5AC15F
- SHA-256: F40B41A46A5646A45F51AE0DE2B7263E4F3B6EBAC795B539DB3811F4B4333A79
- SPKI SHA-256: 4E689536A4625544E0971C5EFCF5C1318EA1B5E3CA1EA4FBA3A82E2BA0DCB37F
- Validity: 2025-04-09 to 2029-05-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/smimersa/smimersarootca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:ae:8d:d0:83:08:3e:82:f8:a3:cd:5a:c1:5f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr  9 06:02:48 2025 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM SMIME RSA Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Subject Key Identifier:
                7B:E1:9C:A8:36:1C:47:A4:04:FB:01:82:6F:BA:71:41:35:1C:30:B0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F40B41A46A5646A45F51AE0DE2B7263E4F3B6EBAC795B539DB3811F4B4333A79
    SPKI SHA256: 4E689536A4625544E0971C5EFCF5C1318EA1B5E3CA1EA4FBA3A82E2BA0DCB37F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM TimeStamping CA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0DE
- SHA-256: 1D709B2884EC093E5D77A504971E887163044734F6DA70C923A4F3FF8D4E5B49
- SPKI SHA-256: 6CA673354B74FB336E8DB98F1E7FFA758571C6975726E983457C7ED97BC67625
- Validity: 2011-06-28 to 2022-07-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159326 (0x12b9b0de)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jun 28 11:47:06 2011 GMT
            Not After : Jul 29 11:47:06 2022 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                88:03:F9:11:CF:3B:3E:E3:4C:93:E5:1A:EF:2D:65:21:F2:32:33:2E
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1D709B2884EC093E5D77A504971E887163044734F6DA70C923A4F3FF8D4E5B49
    SPKI SHA256: 6CA673354B74FB336E8DB98F1E7FFA758571C6975726E983457C7ED97BC67625
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM TimeStamping CA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B11D7D6AC5C2CD03D5CD25232EDF
- SHA-256: 09DE1E988A7F0179E1E3B7BC2B7B4A22C2816BC835ABEFCE586E5785128140E1
- SPKI SHA-256: 6CA673354B74FB336E8DB98F1E7FFA758571C6975726E983457C7ED97BC67625
- Validity: 2021-07-12 to 2023-09-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO.,LTD.
- CP/CPS: https://repo1.secomtrust.net/spcpp/ts/TSCA-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/ts/ca1/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:b9:b1:1d:7d:6a:c5:c2:cd:03:d5:cd:25:23:2e:df
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jul 12 08:15:22 2021 GMT
            Not After : Sep 30 04:20:49 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                88:03:F9:11:CF:3B:3E:E3:4C:93:E5:1A:EF:2D:65:21:F2:32:33:2E
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: http://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 09DE1E988A7F0179E1E3B7BC2B7B4A22C2816BC835ABEFCE586E5785128140E1
    SPKI SHA256: 6CA673354B74FB336E8DB98F1E7FFA758571C6975726E983457C7ED97BC67625
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SECOM TimeStamping CA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0F5150C9CB58A
- SHA-256: 225113CEDA68FBAB5E628E0214A15A651C47AA7EE7BBF476099B6E142EECC8EC
- SPKI SHA-256: 905B0B316B9D3A6ED02C094BA8389C6D5570EC36AA876E76A4B1A3A8AAC73D0E
- Validity: 2016-03-29 to 2026-03-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:f5:15:0c:9c:b5:8a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Mar 29 05:18:39 2016 GMT
            Not After : Mar 29 05:18:39 2026 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                07:4D:13:7D:EA:B7:FA:ED:93:D4:93:77:3F:58:13:00:CB:E1:23:89
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 225113CEDA68FBAB5E628E0214A15A651C47AA7EE7BBF476099B6E142EECC8EC
    SPKI SHA256: 905B0B316B9D3A6ED02C094BA8389C6D5570EC36AA876E76A4B1A3A8AAC73D0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SECOM TimeStamping CA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18D4E99D73CB4EC2BEA646E1AE6
- SHA-256: 2AF80BCD3A5A53406FF22271DB84B938417E8C338E5AA28CC47575FD41F22615
- SPKI SHA-256: 905B0B316B9D3A6ED02C094BA8389C6D5570EC36AA876E76A4B1A3A8AAC73D0E
- Validity: 2021-07-12 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/ts/ca2/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:8d:4e:99:d7:3c:b4:ec:2b:ea:64:6e:1a:e6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jul 12 06:47:19 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                07:4D:13:7D:EA:B7:FA:ED:93:D4:93:77:3F:58:13:00:CB:E1:23:89
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2AF80BCD3A5A53406FF22271DB84B938417E8C338E5AA28CC47575FD41F22615
    SPKI SHA256: 905B0B316B9D3A6ED02C094BA8389C6D5570EC36AA876E76A4B1A3A8AAC73D0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM TimeStamping CA3

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA3
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 0100003E344C91C7CC
- SHA-256: 0E984339724A267C2A3DC4FCC8D020B3B4BA329A0AD7E390CFBF76E88823E11B
- SPKI SHA-256: 202D95FD2AFD6A62968B60790038E381640BD3FB7C96F54F4A8F31A51E8A978F
- Validity: 2018-06-07 to 2037-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/ts/ca3/fullCRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:3e:34:4c:91:c7:cc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Jun  7 05:12:31 2018 GMT
            Not After : Dec 31 05:12:31 2037 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                19:9D:FA:BC:5C:34:55:AF:3C:C5:9B:4D:BB:A3:A5:96:39:28:88:44
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.7
                  CPS: https://repository.secomtrust.net/SC-Root3/
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0E984339724A267C2A3DC4FCC8D020B3B4BA329A0AD7E390CFBF76E88823E11B
    SPKI SHA256: 202D95FD2AFD6A62968B60790038E381640BD3FB7C96F54F4A8F31A51E8A978F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.7
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SECOM TimeStamping CA4

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 0100004BD4F49CF31A08CB1F6953D0DD
- SHA-256: 3CFC266D4E23BCF70E99CC7918ED578A300498F00C8BBD123250BDEE5A2BEC5B
- SPKI SHA-256: 9DA8E56FD01F86FD3229DE584C034D7C6D56888609640584A67437C5D99FEF26
- Validity: 2020-12-15 to 2037-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/ts/ca4/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:4b:d4:f4:9c:f3:1a:08:cb:1f:69:53:d0:dd
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Dec 15 09:48:40 2020 GMT
            Not After : Dec 31 14:59:59 2037 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                60:81:1F:0D:E8:23:DC:6E:B0:19:49:BE:E7:F9:0D:24:48:C1:9D:B6
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.7
                  CPS: http://repository.secomtrust.net/SC-Root3/
            X509v3 Extended Key Usage:
                Time Stamping
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3CFC266D4E23BCF70E99CC7918ED578A300498F00C8BBD123250BDEE5A2BEC5B
    SPKI SHA256: 9DA8E56FD01F86FD3229DE584C034D7C6D56888609640584A67437C5D99FEF26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.7
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM TimeStamping CA4

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SECOM TimeStamping CA4
- Issuer: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM RSA Root CA 2023
- Serial: 010000057397549EA8FB9F7ED5DD6EEC
- SHA-256: 9B7A75CCF8D0EDAC6088D40F14B6D20C85C69B2B7F5A2C957FB1C2BC5870BAF5
- SPKI SHA-256: 9DA8E56FD01F86FD3229DE584C034D7C6D56888609640584A67437C5D99FEF26
- Validity: 2023-02-24 to 2043-02-01
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems Co., Ltd.
- CP/CPS: https://repo1.secomtrust.net/spcpp/ts/TSCA-CP-EN.pdf, https://repo1.secomtrust.net/spcpp/cps/SECOM-CPS-EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/spcpp/ts/ca4/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://rsarootca2023.ocsp.secom-cert.jp
- CRL DP: http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:05:73:97:54:9e:a8:fb:9f:7e:d5:dd:6e:ec
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM RSA Root CA 2023
        Validity
            Not Before: Feb 24 07:12:49 2023 GMT
            Not After : Feb  1 00:00:00 2043 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SECOM TimeStamping CA4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                60:81:1F:0D:E8:23:DC:6E:B0:19:49:BE:E7:F9:0D:24:48:C1:9D:B6
            X509v3 Authority Key Identifier:
                51:33:6A:2A:EF:DB:1F:80:ED:B2:C6:D3:06:D2:25:93:C4:C8:B6:66
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.9
                  CPS: http://repo1.secomtrust.net/root/rsa/
            Authority Information Access:
                OCSP - URI:http://rsarootca2023.ocsp.secom-cert.jp
                CA Issuers - URI:http://repo2.secomtrust.net/root/rsa/rsarootca2023.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9B7A75CCF8D0EDAC6088D40F14B6D20C85C69B2B7F5A2C957FB1C2BC5870BAF5
    SPKI SHA256: 9DA8E56FD01F86FD3229DE584C034D7C6D56888609640584A67437C5D99FEF26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.392.200091.100.901.9
- AIA OCSP: http://rsarootca2023.ocsp.secom-cert.jp
- AIA CA Issuers: http://repo2.secomtrust.net/root/rsa/rsarootca2023.cer
- CRL Distribution Points: http://repo1.secomtrust.net/root/rsa/rsarootca2023.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM TLS ECC Root CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS ECC Root CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 1DAFAA4C43ACB4320140CC9197BE2826
- SHA-256: 22DA96F19EFC0429034A22755E9D7FE4746B3CAD56A013ED1C02F142A722B9A7
- SPKI SHA-256: 294679E0F97FFD474F19567B36382394E1B4960E030975E66353452034A3C5EA
- Validity: 2025-04-09 to 2038-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/tlsecc/tlseccrootca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:af:aa:4c:43:ac:b4:32:01:40:cc:91:97:be:28:26
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Apr  9 06:34:14 2025 GMT
            Not After : Jan 18 00:00:00 2038 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS ECC Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Subject Key Identifier:
                3B:76:11:7B:29:74:E2:4E:06:4C:56:82:40:D0:21:2F:7A:B3:C9:D5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 22DA96F19EFC0429034A22755E9D7FE4746B3CAD56A013ED1C02F142A722B9A7
    SPKI SHA256: 294679E0F97FFD474F19567B36382394E1B4960E030975E66353452034A3C5EA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SECOM TLS RSA Root CA 2024

- Subject: countryName=JP, organizationName=SECOM Trust Systems Co., Ltd., commonName=SECOM TLS RSA Root CA 2024
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1AD80E6588256D070530F78522D
- SHA-256: C8FB5BB81193CA9B531E2A0A568F14CC75D20924B98D2724DD243F63D813CF13
- SPKI SHA-256: F0E0B6FBE8B74D4F82D8ED8F8BD6A3D083DC19DB3D2CEDB1061CCB76D848EE7D
- Validity: 2025-04-09 to 2029-05-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/root/tlsrsa/tlsrsarootca2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:ad:80:e6:58:82:56:d0:70:53:0f:78:52:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr  9 05:28:15 2025 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems Co., Ltd.", CN = SECOM TLS RSA Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Subject Key Identifier:
                2C:EB:72:12:8E:58:77:64:35:15:56:35:01:57:07:A9:7D:0D:36:E6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C8FB5BB81193CA9B531E2A0A568F14CC75D20924B98D2724DD243F63D813CF13
    SPKI SHA256: F0E0B6FBE8B74D4F82D8ED8F8BD6A3D083DC19DB3D2CEDB1061CCB76D848EE7D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Security Communication ECC RootCA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B1A49DB1D47C2674294CEE84F8FC
- SHA-256: C3EBCEA7E6B13AC3EB3A79F05819E67D6893C65642F50D9B5E1647CB26506B8E
- SPKI SHA-256: 3329BFA13B6007AB5FC3713F0ACB289426E2FBC99CC5C110A914B139571600B6
- Validity: 2024-04-04 to 2029-05-29
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:a4:9d:b1:d4:7c:26:74:29:4c:ee:84:f8:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Apr  4 06:22:18 2024 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Subject Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C3EBCEA7E6B13AC3EB3A79F05819E67D6893C65642F50D9B5E1647CB26506B8E
    SPKI SHA256: 3329BFA13B6007AB5FC3713F0ACB289426E2FBC99CC5C110A914B139571600B6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root2/SCRoot2ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Security Communication EV RootCA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0BB
- SHA-256: 1D1D99456F9D44D3921D6711841950C0DF2BB76C91A0D33637E7F94B0EE5E3BC
- SPKI SHA-256: 6544FF9ADB642C4C3698A60D8143B6B93BCEF01365B540F614DCC2A45AB94D31
- Validity: 2007-06-14 to 2017-06-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159291 (0x12b9b0bb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Jun 14 11:16:30 2007 GMT
            Not After : Jun 14 11:16:30 2017 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication EV RootCA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                35:4A:F5:4D:AF:3F:D7:82:38:AC:AB:71:65:17:75:8C:9D:55:93:E6
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 1D1D99456F9D44D3921D6711841950C0DF2BB76C91A0D33637E7F94B0EE5E3BC
    SPKI SHA256: 6544FF9ADB642C4C3698A60D8143B6B93BCEF01365B540F614DCC2A45AB94D31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Security Communication EV RootCA1

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication EV RootCA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E4
- SHA-256: E5AD411164AF69216B768D5272E564C2A08FFFE20A547065119545AF03BEFEF0
- SPKI SHA-256: 6544FF9ADB642C4C3698A60D8143B6B93BCEF01365B540F614DCC2A45AB94D31
- Validity: 2012-11-13 to 2022-11-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159332 (0x12b9b0e4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Nov 13 04:55:55 2012 GMT
            Not After : Nov 13 04:55:55 2022 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication EV RootCA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                35:4A:F5:4D:AF:3F:D7:82:38:AC:AB:71:65:17:75:8C:9D:55:93:E6
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E5AD411164AF69216B768D5272E564C2A08FFFE20A547065119545AF03BEFEF0
    SPKI SHA256: 6544FF9ADB642C4C3698A60D8143B6B93BCEF01365B540F614DCC2A45AB94D31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Security Communication RootCA2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0FA72E0D848C6
- SHA-256: C415CEBFA3FC2EF3C74092B84265BAD64C3FC9994C91177965667D7ABEE90588
- SPKI SHA-256: 3380709AF3B096BE3CC2A40548142C0A520028DB09E2CB77AE2206616AB6CBB4
- Validity: 2015-03-24 to 2023-09-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems CO., LTD.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:b9:b0:fa:72:e0:d8:48:c6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Mar 24 02:22:35 2015 GMT
            Not After : Sep 29 02:22:35 2023 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/SC-Root1/
            Authority Information Access:
                OCSP - URI:http://scrootca1.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C415CEBFA3FC2EF3C74092B84265BAD64C3FC9994C91177965667D7ABEE90588
    SPKI SHA256: 3380709AF3B096BE3CC2A40548142C0A520028DB09E2CB77AE2206616AB6CBB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://scrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Servision Certification Authority

- Subject: countryName=JP, organizationName=Servision Inc., commonName=Servision Certification Authority
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E3
- SHA-256: 397166C01890A01502808DACC5C8DFD4BF2FDFCDC1A6ACC3CB1421D96CF338FD
- SPKI SHA-256: 916BE0D1956DDC61E294A28E77125C72BF0453608C43F213A3824E95698F6A6A
- Validity: 2012-11-08 to 2022-11-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159331 (0x12b9b0e3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Nov  8 04:49:31 2012 GMT
            Not After : Nov  8 04:49:31 2022 GMT
        Subject: C = JP, O = Servision Inc., CN = Servision Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                04:35:F9:47:B1:EE:2B:A2:55:09:AE:30:5B:B7:90:CA:AC:57:5D:C7
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 397166C01890A01502808DACC5C8DFD4BF2FDFCDC1A6ACC3CB1421D96CF338FD
    SPKI SHA256: 916BE0D1956DDC61E294A28E77125C72BF0453608C43F213A3824E95698F6A6A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SMBC Certificate Authority CA2

- Subject: countryName=JP, organizationName=Sumitomo Mitsui Banking Corporation, organizationalUnitName=SMBC Authority, commonName=SMBC Certificate Authority CA2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0EAB880562A14
- SHA-256: 0027C852E6A0A74EAD844B5FAC2434CC24966853C84CE63212468881B616665D
- SPKI SHA-256: F0351A44CD8B6E64BC72F796075AD43838DD6B2145793EC81E902A8422D52387
- Validity: 2015-11-25 to 2025-11-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/SMBC2/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b0:ea:b8:80:56:2a:14
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Nov 25 06:38:29 2015 GMT
            Not After : Nov 25 06:38:29 2025 GMT
        Subject: C = JP, O = Sumitomo Mitsui Banking Corporation, OU = SMBC Authority, CN = SMBC Certificate Authority CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                5F:2B:8D:9D:BA:6B:0C:AD:E1:5F:17:61:64:48:A0:95:2A:96:F0:87
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0027C852E6A0A74EAD844B5FAC2434CC24966853C84CE63212468881B616665D
    SPKI SHA256: F0351A44CD8B6E64BC72F796075AD43838DD6B2145793EC81E902A8422D52387
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SMBC Certificate Authority CA2

- Subject: countryName=JP, organizationName=Sumitomo Mitsui Banking Corporation, organizationalUnitName=SMBC Authority, commonName=SMBC Certificate Authority CA2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B18FB4B469F41224BD4D771CD48F
- SHA-256: 7B2EE6E46480EE7C43F759D45BEDBD3D7A5BEDEE8B888CEAAB3D811644AC4682
- SPKI SHA-256: F0351A44CD8B6E64BC72F796075AD43838DD6B2145793EC81E902A8422D52387
- Validity: 2021-08-13 to 2029-05-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/sppca/SMBC2/CPCPS_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/SMBC2/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:b9:b1:8f:b4:b4:69:f4:12:24:bd:4d:77:1c:d4:8f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Aug 13 05:45:33 2021 GMT
            Not After : May 29 05:00:39 2029 GMT
        Subject: C = JP, O = Sumitomo Mitsui Banking Corporation, OU = SMBC Authority, CN = SMBC Certificate Authority CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                5F:2B:8D:9D:BA:6B:0C:AD:E1:5F:17:61:64:48:A0:95:2A:96:F0:87
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: http://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7B2EE6E46480EE7C43F759D45BEDBD3D7A5BEDEE8B888CEAAB3D811644AC4682
    SPKI SHA256: F0351A44CD8B6E64BC72F796075AD43838DD6B2145793EC81E902A8422D52387
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SMBC Certificate Authority CA2 G2

- Subject: countryName=JP, organizationName=Sumitomo Mitsui Banking Corporation, organizationalUnitName=SMBC Authority, commonName=SMBC Certificate Authority CA2 G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 0100004AF02424DAF397BD4AEA6B8D10
- SHA-256: FB6F8CF1EB756CB6C1E61571CADADC46FFA8871F686CAAE0F775B25A8B8AD701
- SPKI SHA-256: 86226678A8D5EF2D5EF94C4E2CC6BB335F7C5965A7184A7AD58273AABBF488C6
- Validity: 2020-11-06 to 2030-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repo1.secomtrust.net/sppca/SMBC2/CPCPS.pdf, https://repo1.secomtrust.net/sppca/SMBC2/CPCPS.pdf, https://repo1.secomtrust.net/sppca/SMBC2/CPCPS_EN.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/sppca/SMBC2/SMBCG2/fullCRL.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:4a:f0:24:24:da:f3:97:bd:4a:ea:6b:8d:10
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Nov  6 05:09:15 2020 GMT
            Not After : Dec 31 14:59:59 2030 GMT
        Subject: C = JP, O = Sumitomo Mitsui Banking Corporation, OU = SMBC Authority, CN = SMBC Certificate Authority CA2 G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0D:A7:56:6D:6F:E3:CE:A3:1B:AA:DB:02:52:F7:10:9D:31:44:42:FF
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.6
                  CPS: http://repository.secomtrust.net/SC-Root3/
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FB6F8CF1EB756CB6C1E61571CADADC46FFA8871F686CAAE0F775B25A8B8AD701
    SPKI SHA256: 86226678A8D5EF2D5EF94C4E2CC6BB335F7C5965A7184A7AD58273AABBF488C6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 1.2.392.200091.100.901.6
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Subordinate Advanced CA G2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced CA G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 30A17636C0717E766F712F6A440D5CDE
- SHA-256: 99125F172262B5D9329E9A3312ACD29D91181B9619FCD97460003DCAAF9A4518
- SPKI SHA-256: 772AFFF217B76F2D7A553CD3EF24C44F78D160AC0B31B70305A9773FA811A192
- Validity: 2024-09-25 to 2038-01-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/subadvcag2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:a1:76:36:c0:71:7e:76:6f:71:2f:6a:44:0d:5c:de
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Sep 25 04:43:09 2024 GMT
            Not After : Jan 18 00:00:00 2038 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Subordinate Advanced CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D7:CE:EC:81:B8:6D:07:E1:90:55:78:95:1A:26:71:4C:AB:B1:EA:9C
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.6
                  CPS: http://repository.secomtrust.net/SC-Root3/
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:secom-cert.jp
                  DirName:C = JP, ST = Tokyo, L = Shinjuku, O = "SECOM Trust Systems CO.,LTD."
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 99125F172262B5D9329E9A3312ACD29D91181B9619FCD97460003DCAAF9A4518
    SPKI SHA256: 772AFFF217B76F2D7A553CD3EF24C44F78D160AC0B31B70305A9773FA811A192
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.6
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_invalid_ca_certificate_policies: At least one CABF reserved policy OIDs MUST be present in a policy-restricted CA cert

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Subordinate Advanced CA G2_2020-2030

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced CA G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 010000498DBED2019F9CC85207ECB35E
- SHA-256: 3657927290B61F6CC9812B002431539B9734CB65A968576750C76BF24965E96A
- SPKI SHA-256: 772AFFF217B76F2D7A553CD3EF24C44F78D160AC0B31B70305A9773FA811A192
- Validity: 2020-10-07 to 2030-10-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems Co., Ltd.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/subadvcag2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:49:8d:be:d2:01:9f:9c:c8:52:07:ec:b3:5e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Oct  7 05:10:02 2020 GMT
            Not After : Oct  7 05:10:02 2030 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Subordinate Advanced CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D7:CE:EC:81:B8:6D:07:E1:90:55:78:95:1A:26:71:4C:AB:B1:EA:9C
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.6
                  CPS: http://repository.secomtrust.net/SC-Root3/
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:secomtrust.net
                  DNS:secure-demo.jp
                  DNS:secom-cert.jp
                  DirName:C = JP, ST = Tokyo, L = Shibuya, O = "SECOM Trust Systems CO.,LTD."
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3657927290B61F6CC9812B002431539B9734CB65A968576750C76BF24965E96A
    SPKI SHA256: 772AFFF217B76F2D7A553CD3EF24C44F78D160AC0B31B70305A9773FA811A192
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.901.6
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-Root3/SCRoot3ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Subordinate Advanced CA1_2016-2019

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced CA1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication RootCA3
- Serial: 0100003432DAC5EEB3
- SHA-256: 967600DBE7425786F5768FEB2DF01F09E060466ED5D15631B175CB0898C3D96E
- SPKI SHA-256: BD03DE8A274CA4EE3713E8D29EB960137450B17A5D3A22F6C9E10EA390B60FF7
- Validity: 2016-12-15 to 2019-12-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221097, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221096
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:34:32:da:c5:ee:b3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication RootCA3
        Validity
            Not Before: Dec 15 08:05:22 2016 GMT
            Not After : Dec 15 08:05:22 2019 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Subordinate Advanced CA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                3E:3A:CF:5D:EA:13:33:BB:02:B0:74:58:3C:58:CA:7F:D0:A3:7C:FD
            X509v3 Authority Key Identifier:
                64:14:7C:FC:58:72:16:A6:0A:29:34:15:6F:2A:CB:BC:FC:AF:A8:AB
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.6
                  CPS: https://repository.secomtrust.net/SC-Root3/
            Authority Information Access:
                OCSP - URI:http://scrootca3.ocsp.secomtrust.net
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 967600DBE7425786F5768FEB2DF01F09E060466ED5D15631B175CB0898C3D96E
    SPKI SHA256: BD03DE8A274CA4EE3713E8D29EB960137450B17A5D3A22F6C9E10EA390B60FF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.901.6
- AIA OCSP: http://scrootca3.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root3/SCRoot3CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Subordinate Advanced ECC CA G2

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced ECC CA G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 1DAFAA492A280D4D6FFA6ADDFCFB3A1A
- SHA-256: 6CCF52765B3B35B476030F16ECE24279DC87FC10CC784BC0E04919E904D25407
- SPKI SHA-256: D5BFA17610D82A92703B8D26D46B40A8D927E65BA8ED5F006202B3CFE759FD86
- Validity: 2024-09-25 to 2038-01-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/subadvecccag2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:af:aa:49:2a:28:0d:4d:6f:fa:6a:dd:fc:fb:3a:1a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Sep 25 05:16:21 2024 GMT
            Not After : Jan 18 00:00:00 2038 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Subordinate Advanced ECC CA G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DF:B2:B7:B0:38:7E:2C:3F:4F:EE:6E:4D:84:00:16:D2:55:2C:30:49
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: http://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:secom-cert.jp
                  DirName:C = JP, ST = Tokyo, L = Shinjuku, O = "SECOM Trust Systems CO.,LTD."
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6CCF52765B3B35B476030F16ECE24279DC87FC10CC784BC0E04919E904D25407
    SPKI SHA256: D5BFA17610D82A92703B8D26D46B40A8D927E65BA8ED5F006202B3CFE759FD86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys
- [historical] error e_invalid_ca_certificate_policies: At least one CABF reserved policy OIDs MUST be present in a policy-restricted CA cert

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Subordinate Advanced ECC CA G2_2020-2030

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced ECC CA G2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 0100004BAF19AADA04CBC28D627A1C31
- SHA-256: BDBF06CE9E56C4507FC24ED7FE1FBEBAA9B6C83A5C6D7C22C39911D9F5125E5A
- SPKI SHA-256: D5BFA17610D82A92703B8D26D46B40A8D927E65BA8ED5F006202B3CFE759FD86
- Validity: 2020-10-07 to 2030-10-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SECOM Trust Systems Co., Ltd.
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://repo1.secomtrust.net/subadvecccag2/fullcrl.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:4b:af:19:aa:da:04:cb:c2:8d:62:7a:1c:31
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Oct  7 06:00:32 2020 GMT
            Not After : Oct  7 06:00:32 2030 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Subordinate Advanced ECC CA G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DF:B2:B7:B0:38:7E:2C:3F:4F:EE:6E:4D:84:00:16:D2:55:2C:30:49
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: http://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
                CA Issuers - URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
            X509v3 Name Constraints: critical
                Permitted:
                  DNS:secomtrust.net
                  DNS:secure-demo.jp
                  DNS:secom-cert.jp
                  DirName:C = JP, ST = Tokyo, L = Shibuya, O = "SECOM Trust Systems CO.,LTD."
                Excluded:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BDBF06CE9E56C4507FC24ED7FE1FBEBAA9B6C83A5C6D7C22C39911D9F5125E5A
    SPKI SHA256: D5BFA17610D82A92703B8D26D46B40A8D927E65BA8ED5F006202B3CFE759FD86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1ca.cer
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":true,"critical":true,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Subordinate Advanced ECC CA1_2016-2019

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Subordinate Advanced ECC CA1
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=Security Communication ECC RootCA1
- Serial: 010000349A43149790
- SHA-256: CD42341E085A9B3C2E82DF68850107B6ED2C14F6AA50C69CFC318AC3B88240A7
- SPKI SHA-256: 6160BEF7404FAEEE46ABFADB20A9FC2213C85BC43B9A4ABB8D55A2E86F07A4FC
- Validity: 2016-12-15 to 2019-12-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221097, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=221096
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:34:9a:43:14:97:90
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Security Communication ECC RootCA1
        Validity
            Not Before: Dec 15 08:31:14 2016 GMT
            Not After : Dec 15 08:31:14 2019 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = Subordinate Advanced ECC CA1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                B4:74:09:75:AF:67:AE:86:76:8A:44:2C:3E:D4:F7:20:F8:AF:03:4C
            X509v3 Authority Key Identifier:
                86:1C:E7:FE:2D:A5:4A:8B:08:FE:28:11:FA:BE:A3:66:F8:60:59:2F
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.902.1
                  CPS: https://repository.secomtrust.net/SC-ECC-Root1/
            Authority Information Access:
                OCSP - URI:http://sceccrootca1.ocsp.secomtrust.net
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CD42341E085A9B3C2E82DF68850107B6ED2C14F6AA50C69CFC318AC3B88240A7
    SPKI SHA256: 6160BEF7404FAEEE46ABFADB20A9FC2213C85BC43B9A4ABB8D55A2E86F07A4FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.392.200091.100.902.1
- AIA OCSP: http://sceccrootca1.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-ECC-Root1/SCECCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### SubordinateCA1

- Subject: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=SubordinateCA1
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0C5
- SHA-256: 0A6A58917718AC83F249D253F7A18019BC51E04E43C429DA863B73832AA56EAA
- SPKI SHA-256: FE089947A0178550F97F54E3A121C0164C28ECA11FD75BB4DF1C790AEE24C2FB
- Validity: 2009-02-17 to 2019-02-17
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159301 (0x12b9b0c5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Feb 17 05:53:13 2009 GMT
            Not After : Feb 17 05:53:13 2019 GMT
        Subject: C = JP, O = SECOM Trust.net, OU = SubordinateCA1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                54:07:18:FE:DC:28:EE:9D:16:84:94:6E:D9:4C:29:47:39:71:AB:D2
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0A6A58917718AC83F249D253F7A18019BC51E04E43C429DA863B73832AA56EAA
    SPKI SHA256: FE089947A0178550F97F54E3A121C0164C28ECA11FD75BB4DF1C790AEE24C2FB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SubordinateCA6_2009-2019

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SubordinateCA6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0A2
- SHA-256: 15F6CD58840A471831AB7759BFE997A1DAC23A816510DC716B0E386CBC576CF6
- SPKI SHA-256: 3A1905CABFC633B4EDA4734D08AAA2D34A6D6674AF113C8AB253C1495E024F7B
- Validity: 2009-10-28 to 2019-10-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594722 (0x22b9b0a2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Oct 28 04:46:25 2009 GMT
            Not After : Oct 28 04:46:25 2019 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SubordinateCA6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                94:1B:43:F0:AC:1F:A0:95:82:74:98:0B:8E:AC:B7:29:0A:18:24:0A
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.secomtrust.net/SC-Root2/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 15F6CD58840A471831AB7759BFE997A1DAC23A816510DC716B0E386CBC576CF6
    SPKI SHA256: 3A1905CABFC633B4EDA4734D08AAA2D34A6D6674AF113C8AB253C1495E024F7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### SubordinateCA6_2009-2019

- Subject: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., commonName=SubordinateCA6
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0A1
- SHA-256: CC144024022DFB402B0F8647EBF769E4F983C76F43F2C3938F8513E73B830791
- SPKI SHA-256: 3A1905CABFC633B4EDA4734D08AAA2D34A6D6674AF113C8AB253C1495E024F7B
- Validity: 2009-06-11 to 2019-06-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594721 (0x22b9b0a1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Jun 11 07:08:51 2009 GMT
            Not After : Jun 11 07:08:51 2019 GMT
        Subject: C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = SubordinateCA6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                94:1B:43:F0:AC:1F:A0:95:82:74:98:0B:8E:AC:B7:29:0A:18:24:0A
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CC144024022DFB402B0F8647EBF769E4F983C76F43F2C3938F8513E73B830791
    SPKI SHA256: 3A1905CABFC633B4EDA4734D08AAA2D34A6D6674AF113C8AB253C1495E024F7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### UPKI

- Subject: countryName=JP, localityName=Academe, organizationName=National Institute of Informatics, organizationalUnitName=UPKI, organizationalUnitName=NII Open Domain CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0B6
- SHA-256: 8B00B61016E97D81D547575FE15AC4351F0BA1EAF28F8669486320A932423CD2
- SPKI SHA-256: 3A7ADE72AC8BC3B8EC6D3D691C56C22D72EF4506B9E4C917E790B3BC1676581E
- Validity: 2007-02-13 to 2017-02-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159286 (0x12b9b0b6)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Feb 13 12:01:44 2007 GMT
            Not After : Feb 13 12:01:44 2017 GMT
        Subject: C = JP, L = Academe, O = National Institute of Informatics, OU = UPKI, OU = NII Open Domain CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D9:53:20:3D:76:F3:E0:92:4E:BE:55:5A:FD:65:7F:0C:FF:91:7A:A5
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8B00B61016E97D81D547575FE15AC4351F0BA1EAF28F8669486320A932423CD2
    SPKI SHA256: 3A7ADE72AC8BC3B8EC6D3D691C56C22D72EF4506B9E4C917E790B3BC1676581E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### UPKI

- Subject: countryName=JP, localityName=Academe2, organizationName=National Institute of Informatics, organizationalUnitName=UPKI, organizationalUnitName=NII Open Domain CA - G2
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0C7
- SHA-256: 817D4E05063D5942869C47D8504DC56A5208F7569C3D6D67F3457CFE921B3E29
- SPKI SHA-256: 5C722CB70FB311F21E0DA0E7D12EBC8E05F60796BC49CF511849D5BC62030382
- Validity: 2009-03-27 to 2019-03-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159303 (0x12b9b0c7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Mar 27 03:13:51 2009 GMT
            Not After : Mar 27 03:13:51 2019 GMT
        Subject: C = JP, L = Academe2, O = National Institute of Informatics, OU = UPKI, OU = NII Open Domain CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                7B:0A:07:F7:18:CA:8C:0E:D6:DA:BC:50:80:6C:2C:47:02:D1:0D:FB
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 817D4E05063D5942869C47D8504DC56A5208F7569C3D6D67F3457CFE921B3E29
    SPKI SHA256: 5C722CB70FB311F21E0DA0E7D12EBC8E05F60796BC49CF511849D5BC62030382
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### XiPS CA

- Subject: countryName=JP, organizationName=XiPS, commonName=XiPS CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E7
- SHA-256: 8432468613D98CADECDF0816C49EA2B7F699F4A11CEC00F578C2BA367B261C08
- SPKI SHA-256: 6AA556BD285ED66CE485615B7AD370F671AAA6CAD5A85DE8C6F54ABE1B0894AF
- Validity: 2012-12-14 to 2022-12-14
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159335 (0x12b9b0e7)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Dec 14 04:34:34 2012 GMT
            Not After : Dec 14 04:34:34 2022 GMT
        Subject: C = JP, O = XiPS, CN = XiPS CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2B:C9:08:D7:C0:A8:D6:E9:41:5D:CD:E1:6B:B0:D8:90:01:0E:63:7C
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8432468613D98CADECDF0816C49EA2B7F699F4A11CEC00F578C2BA367B261C08
    SPKI SHA256: 6AA556BD285ED66CE485615B7AD370F671AAA6CAD5A85DE8C6F54ABE1B0894AF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### XiPS CA2

- Subject: countryName=JP, organizationName=XiPS, commonName=XiPS CA2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0D7
- SHA-256: CC85BF997D2929D38FC01E8122B330F9EFBE38DB3BF3D80177DC12BD559002C4
- SPKI SHA-256: 3DA5E3F9E2D1F825571C3743140DA1DC70DD96C9564FED254BBC4D8CF9EABAC3
- Validity: 2015-02-26 to 2025-02-26
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594775 (0x22b9b0d7)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: Feb 26 06:36:20 2015 GMT
            Not After : Feb 26 06:36:20 2025 GMT
        Subject: C = JP, O = XiPS, CN = XiPS CA2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E9:D0:6C:0F:67:4A:A4:4D:15:E6:E8:98:06:C7:55:36:6C:C6:62:FF
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CC85BF997D2929D38FC01E8122B330F9EFBE38DB3BF3D80177DC12BD559002C4
    SPKI SHA256: 3DA5E3F9E2D1F825571C3743140DA1DC70DD96C9564FED254BBC4D8CF9EABAC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### Yamaguchi Financial Group CA

- Subject: countryName=JP, organizationName=Yamaguchi Financial Group Inc., commonName=Yamaguchi Financial Group CA
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0C8
- SHA-256: D7D4708D131EEDC75562FD6EA56ADCF43A8D9465B7BDB0C4C4ED59FE243F0F0C
- SPKI SHA-256: 85B2156B3A7F976678EB77C529DF06E76E1E69844B02359BB07518D8FA909C07
- Validity: 2009-03-27 to 2019-03-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159304 (0x12b9b0c8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Mar 27 03:28:29 2009 GMT
            Not After : Mar 27 03:28:29 2019 GMT
        Subject: C = JP, O = Yamaguchi Financial Group Inc., CN = Yamaguchi Financial Group CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                00:4E:A8:67:27:19:53:03:64:D2:42:3C:46:88:46:FD:32:DF:FB:21
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D7D4708D131EEDC75562FD6EA56ADCF43A8D9465B7BDB0C4C4ED59FE243F0F0C
    SPKI SHA256: 85B2156B3A7F976678EB77C529DF06E76E1E69844B02359BB07518D8FA909C07
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### YourNet SSL for business

- Subject: countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for business
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E9
- SHA-256: 5DECB61CE93A5040B5B6A4E811D0E5C6E0F1616E0C8990778650144FB11D257C
- SPKI SHA-256: AA7A9DCEBE0AEF1A7161EC354C36B5724C59B1E8E89CEF10F064784DE426058C
- Validity: 2012-12-20 to 2022-12-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159337 (0x12b9b0e9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Dec 20 06:17:28 2012 GMT
            Not After : Dec 20 06:17:28 2022 GMT
        Subject: C = JP, O = "FreeBit Co.,Ltd.", CN = YourNet SSL for business
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                3D:12:09:BD:0D:AA:A9:DB:F7:73:AA:04:22:81:2F:10:CB:01:84:10
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 5DECB61CE93A5040B5B6A4E811D0E5C6E0F1616E0C8990778650144FB11D257C
    SPKI SHA256: AA7A9DCEBE0AEF1A7161EC354C36B5724C59B1E8E89CEF10F064784DE426058C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### YourNet SSL for business2

- Subject: countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for business2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0DB
- SHA-256: BA8B1C54CFAD36944E5391891F6B0FF0FEC1653397984CA70D41C7D4925F9681
- SPKI SHA-256: A18A8F2BEC55512EFE45C52741E09EB66AA6791AD031DA2FC56E015B187E1269
- Validity: 2015-05-27 to 2025-05-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594779 (0x22b9b0db)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: May 27 05:27:17 2015 GMT
            Not After : May 27 05:27:17 2025 GMT
        Subject: C = JP, O = "FreeBit Co.,Ltd.", CN = YourNet SSL for business2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0B:26:26:EE:BE:EB:D6:13:CF:4F:07:09:DD:2B:A4:DD:B0:92:D7:EC
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BA8B1C54CFAD36944E5391891F6B0FF0FEC1653397984CA70D41C7D4925F9681
    SPKI SHA256: A18A8F2BEC55512EFE45C52741E09EB66AA6791AD031DA2FC56E015B187E1269
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired

### YourNet SSL for domain

- Subject: countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for domain
- Issuer: countryName=JP, organizationName=SECOM Trust.net, organizationalUnitName=Security Communication RootCA1
- Serial: 12B9B0E8
- SHA-256: D28033493A5CFEF409C2AEA859B9D42F76B38659158F8EDBB3FB4F8A587A4891
- SPKI SHA-256: C34ACDB574CA94C1EAA97F2EB3B49ECCC3FE12A3AA533309E7EC7D20EBF2623B
- Validity: 2012-12-20 to 2022-12-20
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 314159336 (0x12b9b0e8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = JP, O = SECOM Trust.net, OU = Security Communication RootCA1
        Validity
            Not Before: Dec 20 06:07:08 2012 GMT
            Not After : Dec 20 06:07:08 2022 GMT
        Subject: C = JP, O = "FreeBit Co.,Ltd.", CN = YourNet SSL for domain
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                8D:CF:08:23:03:CA:16:D8:D5:52:60:30:E4:35:1F:95:10:81:7E:B7
            X509v3 Authority Key Identifier:
                A0:73:49:99:68:DC:85:5B:65:E3:9B:28:2F:57:9F:BD:33:BC:07:48
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.1
                  CPS: https://repository.secomtrust.net/SC-Root1/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D28033493A5CFEF409C2AEA859B9D42F76B38659158F8EDBB3FB4F8A587A4891
    SPKI SHA256: C34ACDB574CA94C1EAA97F2EB3B49ECCC3FE12A3AA533309E7EC7D20EBF2623B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root1/SCRoot1CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_aia_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### YourNet SSL for domain2

- Subject: countryName=JP, organizationName=FreeBit Co.,Ltd., commonName=YourNet SSL for domain2
- Issuer: countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
- Serial: 22B9B0DC
- SHA-256: 74A61ADD9F20F9146189C6F7DBC89F57756244FD356664108DAE38B82A3B5250
- SPKI SHA-256: CDDD14AB2BC65FBFA3809C650A3FC1CF0837659B5563EDFB3763741DA416F4DF
- Validity: 2015-05-27 to 2025-05-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- CRL DP: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 582594780 (0x22b9b0dc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = JP, O = "SECOM Trust Systems CO.,LTD.", OU = Security Communication RootCA2
        Validity
            Not Before: May 27 05:33:50 2015 GMT
            Not After : May 27 05:33:50 2025 GMT
        Subject: C = JP, O = "FreeBit Co.,Ltd.", CN = YourNet SSL for domain2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                14:B3:91:65:50:06:79:6B:E8:9D:5D:06:46:66:B3:A9:F3:81:1A:CF
            X509v3 Authority Key Identifier:
                0A:85:A9:77:65:05:98:7C:40:81:F8:0F:97:2C:38:F1:0A:EC:3C:CF
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
            X509v3 Certificate Policies:
                Policy: 1.2.392.200091.100.901.4
                  CPS: https://repository.secomtrust.net/SC-Root2/
            Authority Information Access:
                OCSP - URI:http://scrootca2.ocsp.secomtrust.net
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74A61ADD9F20F9146189C6F7DBC89F57756244FD356664108DAE38B82A3B5250
    SPKI SHA256: CDDD14AB2BC65FBFA3809C650A3FC1CF0837659B5563EDFB3763741DA416F4DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.2.392.200091.100.901.4
- AIA OCSP: http://scrootca2.ocsp.secomtrust.net
- AIA CA Issuers: -
- CRL Distribution Points: http://repository.secomtrust.net/SC-Root2/SCRoot2CRL.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- is_expired
