# CA Owner Audit Dump - SSL.com

Generated: 2026-07-28T06:44:19.869559Z

## CA Owner Summary

- Name: SSL.com
- Country: United States of America
- Website: -
- Problem Reporting: https://www.ssl.com/revoke/
- CP/CPS URLs: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf, https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5b5a316b-6fe4-4449-a18d-8585bb0c113e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://bugzilla.mozilla.org/attachment.cgi?id=8834602, https://bugzilla.mozilla.org/attachment.cgi?id=8834601, https://bugzilla.mozilla.org/attachment.cgi?id=8834599, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbdae5e8-a9b4-4d97-89ee-717ca647fa8a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf1ed8d6-80e8-4379-b180-e69c67470990, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c49a26bd-ee55-4e82-8c8d-5f93db81b55b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73f8f904-3b7f-4d60-b087-fd9ed004d4f5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=506ef1cb-cc1c-4146-a326-5e1522514f3e
- Root Programs: {"mozilla":"Removed","chrome":"Removed","microsoft":"Included","apple":"Blocked"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: https://www.ssl.com/revoke/
- CP/CPS URLs: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf, https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5b5a316b-6fe4-4449-a18d-8585bb0c113e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://bugzilla.mozilla.org/attachment.cgi?id=8834602, https://bugzilla.mozilla.org/attachment.cgi?id=8834601, https://bugzilla.mozilla.org/attachment.cgi?id=8834599, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbdae5e8-a9b4-4d97-89ee-717ca647fa8a, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf1ed8d6-80e8-4379-b180-e69c67470990, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c49a26bd-ee55-4e82-8c8d-5f93db81b55b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73f8f904-3b7f-4d60-b087-fd9ed004d4f5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=506ef1cb-cc1c-4146-a326-5e1522514f3e
- Repository URLs: https://www.ssl.com/repository/, https://www.ssl.com/repository
- Root programs: {"mozilla":"Removed","chrome":"Removed","microsoft":"Included","apple":"Blocked"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA | yes | unknown | 2006-11-07 to 2029-12-31 | - | - | - | current errors: 2 |
| 2 | countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA | yes | unknown | 2006-11-07 to 2029-12-31 | - | - | - | current errors: 2 |
| 3 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 4 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 5 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing ECC Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 6 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing RSA Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 7 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing ECC Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 8 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing RSA Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 9 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC | yes | unknown | 2016-02-12 to 2041-02-12 | - | - | - | clean |
| 10 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA | yes | unknown | 2016-02-12 to 2041-02-12 | - | - | - | clean |
| 11 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2 | yes | unknown | 2017-05-31 to 2042-05-30 | - | - | - | clean |
| 12 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC | yes | unknown | 2016-02-12 to 2041-02-12 | - | - | - | clean |
| 13 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA | yes | unknown | 2016-02-12 to 2041-02-12 | - | - | - | clean |
| 14 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 15 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | unknown | 2022-08-25 to 2046-08-19 | - | - | - | clean |
| 16 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC ECC Root CA 2024 | yes | unknown | 2024-02-19 to 2048-02-13 | - | - | - | current errors: 1 |
| 17 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC RSA Root CA 2024 | yes | unknown | 2024-02-19 to 2048-02-13 | - | - | - | clean |
| 18 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority | yes | unknown | 2017-08-23 to 2042-08-23 | - | - | - | clean |
| 19 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority | yes | unknown | 2017-08-23 to 2042-08-23 | - | - | - | current errors: 2 |
| 20 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority | yes | unknown | 2017-08-23 to 2042-08-23 | - | - | - | current errors: 2 |
| 21 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TLS ECC Root 1 | yes | unknown | 2024-02-05 to 2049-02-03 | - | - | - | current errors: 1 |
| 22 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TLS RSA Root 1 | yes | unknown | 2024-02-05 to 2049-02-03 | - | - | - | clean |
| 23 | countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority | yes | unknown | 2004-11-01 to 2035-01-01 | - | - | - | current errors: 2 |
| 24 | countryName=CY, organizationName=3CX, commonName=3CX CA RSA R1 | yes | current | 2022-01-12 to 2032-01-10 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 25 | countryName=US, organizationName=SSL Corporation, commonName=3CX TLS Issuing RSA CA 2 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 26 | countryName=US, organizationName=SSL Corporation, commonName=AnsonNet TLS Issuing RSA CA 2 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 27 | countryName=GB, stateOrProvinceName=London, localityName=London, organizationName=Anson Network Limited, commonName=AnsonNet TLS Issuing RSA CA R1 | yes | current | 2020-10-06 to 2030-10-04 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 28 | countryName=US, organizationName=SSL Corp, commonName=Blahaj Cloud TLS ECC CA 1 | yes | current | 2026-07-09 to 2036-07-06 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | not_available |
| 29 | countryName=US, organizationName=CLOUDFLARE, INC., commonName=Cloudflare TLS Issuing ECC CA 1 | yes | current | 2023-10-31 to 2033-10-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 30 | countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 2 | yes | current | 2025-05-29 to 2035-05-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 31 | countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 3 | yes | current | 2025-05-29 to 2035-05-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 32 | countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 4 | yes | current | 2025-05-29 to 2035-05-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 33 | countryName=US, organizationName=CLOUDFLARE, INC., commonName=Cloudflare TLS Issuing RSA CA 1 | yes | current | 2023-10-31 to 2033-10-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 34 | countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing RSA CA 2 | yes | current | 2025-05-29 to 2035-05-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 35 | countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing RSA CA 3 | yes | current | 2025-05-29 to 2035-05-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 36 | countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing RSA CA 4 | yes | current | 2025-05-29 to 2035-05-27 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 37 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=Code Signing ECC ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 38 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=Code Signing RSA ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 39 | countryName=US, organizationName=SSL Corporation, commonName=Crowdstrike, Inc. OV TLS Issuing ECC CA 1 | yes | current | 2024-09-26 to 2027-09-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 40 | countryName=US, organizationName=SSL Corporation, commonName=Crowdstrike, Inc. OV TLS Issuing RSA CA 1 | yes | current | 2024-09-26 to 2027-09-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 41 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=docSigning RSA ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 42 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=Document Signing ECC ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 43 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign Code Signing ICA RSA R1 | yes | revoked | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 44 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign Document Signing ICA RSA R1 | yes | revoked | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 45 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign EV TLS ICA ECC R1 | yes | unknown | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 46 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign EV TLS ICA RSA R1 | yes | unknown | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 47 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign SMIME ICA RSA R1 | yes | revoked | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 48 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign TLS ICA ECC R1 | yes | unknown | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 49 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign TLS ICA RSA R1 | yes | unknown | 2019-08-23 to 2029-08-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 50 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for Code Signing | yes | revoked, expired | 2019-01-21 to 2024-01-20 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 51 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for Code Signing R2 | yes | expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 52 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for Code Signing R3 | yes | current | 2023-05-26 to 2033-05-23 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 53 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for EV SSL | yes | revoked, expired | 2019-01-21 to 2024-01-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 54 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for EV SSL R2 | yes | expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 55 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for EV TLS R3 | yes | current | 2023-05-26 to 2033-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 56 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for SSL | yes | revoked, expired | 2019-01-21 to 2024-01-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 57 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for SSL R2 | yes | expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 58 | countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for TLS R3 | yes | current | 2023-05-26 to 2033-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 59 | countryName=US, organizationName=SSL Corporation, commonName=Domain The Net Technologies Ltd TLS Issuing RSA CA 4 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 60 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS ECC CA R1 | yes | current | 2022-02-28 to 2032-02-26 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 61 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS ECC SubCA R1 | yes | current | 2022-03-04 to 2032-02-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 62 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS RSA CA R1 | yes | current | 2022-02-28 to 2032-02-26 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 63 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS RSA SubCA R1 | yes | current | 2022-03-04 to 2032-02-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 64 | countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS ECC CA 2 | yes | current | 2026-06-12 to 2036-06-09 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 65 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS ECC CA R1 | yes | current | 2022-02-28 to 2032-02-26 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 66 | countryName=US, organizationName=SSL Corp, commonName=E-Tugra TLS ECC SubCA 2 | yes | current | 2026-06-12 to 2036-06-09 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 67 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS ECC SubCA R1 | yes | current | 2022-03-04 to 2032-02-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 68 | countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS RSA CA 2 | yes | current | 2026-06-12 to 2036-06-09 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 69 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS RSA CA R1 | yes | current | 2022-02-28 to 2032-02-26 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 70 | countryName=US, organizationName=SSL Corp, commonName=E-Tugra TLS RSA SubCA 2 | yes | current | 2026-06-12 to 2036-06-09 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 71 | countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS RSA SubCA R1 | yes | current | 2022-03-04 to 2032-02-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 72 | countryName=US, organizationName=SSL Corporation, commonName=Entrust DV TLS Issuing ECC CA 1 | yes | current | 2024-08-22 to 2027-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 73 | countryName=US, organizationName=SSL Corporation, commonName=Entrust DV TLS Issuing RSA CA 1 | yes | current | 2024-08-22 to 2027-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 74 | countryName=US, organizationName=SSL Corporation, commonName=Entrust EV TLS Issuing ECC CA 1 | yes | current | 2024-08-22 to 2027-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 75 | countryName=US, organizationName=SSL Corporation, commonName=Entrust EV TLS Issuing RSA CA 1 | yes | current | 2024-08-22 to 2027-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 76 | countryName=US, organizationName=SSL Corporation, commonName=Entrust OV TLS Issuing ECC CA 1 | yes | current | 2024-08-22 to 2027-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 77 | countryName=US, organizationName=SSL Corporation, commonName=Entrust OV TLS Issuing RSA CA 1 | yes | current | 2024-08-22 to 2027-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 78 | countryName=US, organizationName=SSL Corporation, commonName=Euronet TLS Issuing RSA CA 1 | yes | current | 2026-04-09 to 2036-04-06 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 79 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=EV TLS ECC ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 80 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=EV TLS RSA ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 81 | countryName=US, organizationName=Everything Legal, LLC, commonName=EverythingLegal Document Signing Issuing RSA SubCA R1 | yes | current | 2022-03-28 to 2032-03-25 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 82 | countryName=US, organizationName=HEALTH GORILLA, INC., commonName=Health Gorilla Client Auth RSA SubCA 1 | yes | current | 2025-02-04 to 2035-02-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 83 | countryName=US, organizationName=SSL Corporation, commonName=HydrantID Code Signing ECC CA 1 | yes | current | 2026-05-22 to 2034-05-20 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 84 | countryName=US, organizationName=SSL Corporation, commonName=HydrantID TLS ECC CA 1 | yes | current | 2026-05-27 to 2036-05-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 85 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA ECC | yes | revoked | 2019-02-14 to 2029-02-11 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 86 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA ECC R3 | yes | revoked | 2019-03-07 to 2029-03-04 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 87 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA RSA | yes | revoked | 2019-02-14 to 2029-02-11 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 88 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA RSA R3 | yes | revoked | 2019-03-26 to 2029-03-23 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 89 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Code Signing Certificate CA RSA | yes | revoked | 2019-02-14 to 2029-02-11 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 90 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Code Signing Certificate CA RSA R3 | yes | revoked | 2019-03-26 to 2029-03-23 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 91 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud EV SSL Certificate CA RSA | yes | revoked | 2019-02-14 to 2029-02-11 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 92 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud EV SSL Certificate CA RSA R3 | yes | revoked | 2019-03-26 to 2029-03-23 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 93 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA ECC | yes | revoked | 2019-02-14 to 2029-02-11 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 94 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA ECC R2 | yes | revoked | 2019-03-07 to 2029-03-04 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 95 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA RSA | yes | revoked | 2019-02-14 to 2029-02-11 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 96 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA RSA R2 | yes | revoked | 2019-03-26 to 2029-03-23 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 97 | countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for ClientCert ECC | yes | revoked | 2019-01-16 to 2029-01-13 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 98 | countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for ClientCert RSA | yes | revoked | 2019-01-16 to 2029-01-13 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 99 | countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for CodeSigning | yes | revoked | 2019-01-16 to 2029-01-13 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 100 | countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for EV SSL RSA | yes | revoked | 2019-01-16 to 2029-01-13 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 101 | countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL EV TLS Issuing RSA CA 1 | yes | current | 2023-06-26 to 2033-06-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 102 | countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL EV TLS Issuing RSA CA 2 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 103 | countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL TLS Issuing RSA CA 1 | yes | current | 2023-06-26 to 2033-06-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 104 | countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL TLS Issuing RSA CA 2 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 105 | countryName=US, organizationName=Leocert LLC, commonName=Leocert TLS Issuing ECC CA 1 | yes | current | 2024-03-21 to 2034-03-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 106 | countryName=US, organizationName=Leocert LLC, commonName=Leocert TLS Issuing RSA CA 1 | yes | current | 2024-03-21 to 2034-03-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 107 | countryName=SG, organizationName=LEXAGLE PTE. LTD., commonName=Lexagle Document Signing Issuing ECC CA 1 | yes | current | 2023-04-20 to 2033-04-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 108 | countryName=US, stateOrProvinceName=Maryland, localityName=Columbia, organizationName=Micros Systems, Inc., commonName=Micros CA | yes | revoked, expired | 2010-04-01 to 2020-03-29 | 1.3.6.1.4.1.35539.3.3.3.3.3 | 1 | - | historical errors: 1 |
| 109 | countryName=US, stateOrProvinceName=Maryland, localityName=Columbia, organizationName=Micros Systems, Inc., commonName=Micros Internal CA | yes | expired | 2010-04-01 to 2020-03-29 | 1.3.6.1.4.1.35539.3.3.4.3.3 | 0 | - | historical errors: 1 |
| 110 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Client Certificate CA ECC R3 | yes | revoked, expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 111 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Client Certificate CA RSA | yes | revoked, expired | 2019-02-25 to 2024-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 112 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Client Certificate CA RSA R3 | yes | revoked, expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 113 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Code Signing Certificate CA RSA | yes | revoked, expired | 2019-02-25 to 2024-02-24 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 114 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Code Signing Certificate CA RSA R3 | yes | revoked, expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 115 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign EV SSL Certificate CA RSA | yes | revoked, expired | 2019-02-25 to 2024-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 116 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign EV SSL Certificate CA RSA R3 | yes | expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 117 | countryName=MU, organizationName=MilleniumSign Limited, commonName=MilleniumSign for ClientCert RSA | yes | revoked, expired | 2019-01-18 to 2024-01-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 118 | countryName=MU, organizationName=MilleniumSign Limited, commonName=MilleniumSign for Code Signing | yes | revoked, expired | 2019-01-21 to 2024-01-20 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 119 | countryName=MU, organizationName=MilleniumSign Limited, commonName=MilleniumSign for EV SSL | yes | revoked, expired | 2019-01-21 to 2024-01-20 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 120 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign SSL Certificate CA ECC R2 | yes | expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 121 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign SSL Certificate CA RSA | yes | revoked, expired | 2019-02-25 to 2024-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 122 | countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign SSL Certificate CA RSA R2 | yes | expired | 2019-04-01 to 2024-03-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 123 | countryName=US, stateOrProvinceName=New York, localityName=New York, organizationName=MTA-NYCT, commonName=MTA-New York City Transit CA | yes | expired | 2012-02-02 to 2022-01-30 | 1.3.6.1.4.1.38578.3.3.3.3.4.3.3 | 0 | - | historical errors: 1 |
| 124 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing ECC CA 2 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 125 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing ECC CA R1 | yes | current | 2021-11-16 to 2031-11-14 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 126 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing RSA CA 2 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 127 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing RSA CA R1 | yes | current | 2021-11-16 to 2031-11-14 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 128 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing ECC CA 2 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 129 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing ECC CA R1 | yes | current | 2021-11-16 to 2031-11-14 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 130 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing RSA CA 2 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 131 | countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing RSA CA R1 | yes | current | 2021-11-16 to 2031-11-14 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 132 | countryName=US, organizationName=SSL Corporation, commonName=Namirial S.p.A EV TLS Issuing RSA CA 1 | yes | current | 2024-09-26 to 2027-09-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 133 | countryName=US, organizationName=SSL Corporation, commonName=Namirial S.p.A OV TLS Issuing RSA CA 1 | yes | current | 2024-09-26 to 2027-09-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 134 | countryName=US, organizationName=SSL Corporation, commonName=OCLC TLS Issuing RSA CA 2 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 135 | countryName=US, organizationName=OCLC, Inc., commonName=OCLC TLS Issuing RSA SubCA R1 | yes | current | 2022-09-22 to 2032-09-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 136 | countryName=US, organizationName=SSL Corp, commonName=PKIChain TLS Issuing ECC CA 1 | yes | current | 2026-07-09 to 2036-07-06 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | not_available |
| 137 | countryName=US, organizationName=Proof.com, commonName=Proof.com Document Signing ECC CA 1 | yes | current | 2023-09-01 to 2031-08-30 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 138 | countryName=US, organizationName=Proof.com, commonName=Proof.com Document Signing ECC CA 2 | yes | current | 2023-11-24 to 2031-11-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 139 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Basic TLS DV RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 140 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum EV Secure Code Signing CN RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 141 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum EV Secure Code Signing RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 142 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Code Signing CN RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 143 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Code Signing RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 144 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site DV TLS CN RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 145 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site EV Pro TLS CN RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 146 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site EV TLS RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 147 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site OV Pro TLS CN RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 148 | countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site OV TLS RSA R1 | yes | revoked | 2021-02-09 to 2031-02-07 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 149 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=S/MIME ECC ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 150 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=S/MIME RSA ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 151 | countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen ClientCert ICA RSA R1 | yes | current | 2019-10-01 to 2029-09-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 152 | countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen Code Signing ICA RSA R1 | yes | current | 2019-10-01 to 2029-09-28 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 153 | countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen EV TLS ICA RSA R1 | yes | current | 2019-10-01 to 2029-09-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 154 | countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen TLS ICA RSA R1 | yes | current | 2019-10-01 to 2029-09-28 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 155 | countryName=US, organizationName=SSL Corporation, commonName=SafeToOpen TLS Issuing RSA CA 1 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 156 | countryName=GB, organizationName=Sectigo Limited, commonName=Sectigo Limited Document Signing RSA CA 1 | yes | current | 2025-11-19 to 2033-11-17 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36 | clean |
| 157 | countryName=GB, organizationName=Sectigo Limited, commonName=Sectigo Limited VMC Issuing RSA CA 1 | yes | current | 2025-11-13 to 2035-11-11 | 2.5.29.32.0 | 0 | Brand Indicator for Message Identification | clean |
| 158 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak Client Authentication ECC CA 1 | yes | current | 2025-09-23 to 2035-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 159 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak Client Authentication RSA CA 1 | yes | current | 2025-09-23 to 2035-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 160 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak Document Signing ECC CA 1 | yes | current | 2025-09-23 to 2033-09-21 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36 | clean |
| 161 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak Document Signing RSA CA 1 | yes | current | 2025-09-23 to 2033-09-21 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36 | clean |
| 162 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak EV TLS ECC CA 1 | yes | current | 2025-09-23 to 2035-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 163 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak EV TLS RSA CA 1 | yes | current | 2025-09-23 to 2035-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 164 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak S/MIME ECC CA 1 | yes | current | 2025-09-23 to 2033-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 165 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak S/MIME RSA CA 1 | yes | current | 2025-09-23 to 2033-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 166 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak TLS ECC CA 1 | yes | current | 2025-09-23 to 2035-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 167 | countryName=US, organizationName=SSL Corporation, commonName=Securepeak TLS RSA CA 1 | yes | current | 2025-09-23 to 2035-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 168 | commonName=SecureTrust Client Authentication CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2029-01-29 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 169 | commonName=SecureTrust Code Signing CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2029-01-29 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 170 | commonName=SecureTrust Domain Validation CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2029-01-29 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 171 | commonName=SecureTrust Extended Validation CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2029-01-29 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 172 | commonName=SecureTrust Organization Validation CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2029-01-29 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 173 | commonName=SecureTrust Secure Email CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2029-01-29 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 174 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust Secure Email CA, Level 2 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 175 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust Secure Email CA, Level 3 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 176 | commonName=SecureTrust Timestamping CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2019-01-29 to 2034-12-31 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 177 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Client CA, Level 2 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 178 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Client CA, Level 3 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 179 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Client CA, Level 2 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 180 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Client CA, Level 3 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 181 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Secure Email CA, Level 1 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 182 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Secure Email CA, Level 2 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 183 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Client CA, Level 2 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 184 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Client CA, Level 3 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 185 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Secure Email CA, Level 1 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 186 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Secure Email CA, Level 2 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 187 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Secure Email CA, Level 1 | yes | revoked | 2020-09-21 to 2030-09-21 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 188 | countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Secure Email CA, Level 2 | yes | revoked | 2020-10-08 to 2030-10-08 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 189 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z Code Signing CA RSA R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 190 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z Document Signing CA RSA R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 191 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z EV TLS CA ECC R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 192 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z EV TLS CA RSA R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 193 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z SMIME CA RSA R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection | clean |
| 194 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z TLS CA ECC R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 195 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z TLS CA RSA R1 | yes | revoked | 2019-08-22 to 2029-08-19 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 196 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Issuing ECC CA 2 | yes | current | 2026-02-24 to 2036-02-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 197 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Issuing ECC CA R1 | yes | current | 2022-03-21 to 2032-03-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 198 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Issuing RSA CA 2 | yes | current | 2026-02-24 to 2036-02-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 199 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Issuing RSA CA R1 | yes | current | 2022-03-21 to 2032-03-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 200 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Transit ECC CA 2 | yes | current | 2026-02-24 to 2041-02-20 | 2.5.29.32.0 | 1 | TLS Web Client Authentication | clean |
| 201 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit ECC CA R1 | yes | current | 2022-03-21 to 2037-03-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication | clean |
| 202 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Transit RSA CA 2 | yes | current | 2026-02-24 to 2041-02-20 | 2.5.29.32.0 | 1 | TLS Web Client Authentication | clean |
| 203 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit RSA CA R1 | yes | current | 2022-03-21 to 2037-03-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication | clean |
| 204 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Enterprise Intermediate CA RSA R1 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 205 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA ECC R1 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 206 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA ECC R2 | yes | current | 2019-03-07 to 2034-03-03 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 207 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA RSA R1 | yes | current | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 208 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA RSA R2 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 209 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Enterprise Intermediate CA RSA R1 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | - | Code Signing | clean |
| 210 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Intermediate CA ECC R1 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 211 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Intermediate CA ECC R2 | yes | current | 2019-03-07 to 2034-03-03 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 212 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Intermediate CA RSA R1 | yes | current | 2016-06-24 to 2031-06-24 | 2.5.29.32.0 | - | Code Signing | clean |
| 213 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Code Signing Transit ECC CA R1 | yes | current | 2022-02-28 to 2037-02-24 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 214 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing Transit ECC CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 215 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing Transit RSA CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 216 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit ECC CA R1 | yes | current | 2022-03-21 to 2037-03-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 217 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit ECC CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 218 | countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit RSA CA R1 | yes | current | 2022-03-21 to 2037-03-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 219 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit RSA CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 220 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com ECC SSL subCA | yes | revoked | 2016-02-12 to 2031-02-12 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 221 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA ECC R1 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | - | - | clean |
| 222 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA ECC R2 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | - | - | clean |
| 223 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA RSA R1 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | - | - | clean |
| 224 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA RSA R2 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | - | - | clean |
| 225 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA ECC R1 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 226 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA ECC R2 | yes | current | 2019-03-07 to 2034-03-03 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 227 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA RSA R2 | yes | current | 2017-04-06 to 2032-04-06 | 2.5.29.32.0 | 0 | Code Signing | current errors: 1 |
| 228 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA RSA R3 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 229 | countryName=US, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Transit ECC CA R1 | yes | current | 2022-02-28 to 2037-02-24 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 230 | countryName=US, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Transit RSA CA R1 | yes | current | 2022-02-28 to 2037-02-24 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 231 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV ECC SSL subCA | yes | revoked | 2016-02-12 to 2031-02-12 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 232 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Enterprise Intermediate CA ECC R1 | yes | revoked | 2019-01-16 to 2034-01-12 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 233 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Enterprise Intermediate CA RSA R1 | yes | revoked | 2019-01-16 to 2034-01-12 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 234 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC | yes | current | 2026-01-15 to 2034-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 235 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC | yes | current | 2026-01-15 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 236 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC | yes | current | 2019-02-14 to 2027-02-12 | 2.5.29.32.0 | - | - | clean |
| 237 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2 | yes | current | 2025-12-17 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 238 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2 | yes | current | 2026-01-15 to 2034-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 239 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2 | yes | current | 2017-04-06 to 2042-04-05 | - | - | - | clean |
| 240 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV RSA SSL subCA | yes | current | 2016-02-12 to 2031-02-12 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 241 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 242 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Intermediate CA ECC R2 | yes | current | 2019-03-07 to 2034-03-03 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 243 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Intermediate CA RSA R2 | yes | revoked | 2017-04-06 to 2032-04-06 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 244 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Intermediate CA RSA R3 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 245 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Timestamping Intermediate CA RSA R1 | yes | current | 2017-04-06 to 2032-04-05 | 2.5.29.32.0 | 0 | Time Stamping | current errors: 1 |
| 246 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Issuing ECC CA R1 | yes | current | 2022-10-21 to 2032-10-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 247 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Issuing RSA CA R1 | yes | current | 2022-10-21 to 2032-10-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 248 | countryName=US, organizationName=SSL Corp, commonName=SSL.com EV TLS Transit ECC CA R1 | yes | current | 2022-02-28 to 2037-02-24 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 249 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit ECC CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 250 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit RSA CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 251 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Issuing ECC CA 1 | yes | current | 2022-12-09 to 2032-12-06 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 252 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Issuing RSA CA 1 | yes | current | 2022-12-09 to 2032-12-06 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 253 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Transit ECC CA 1 | yes | current | 2022-12-09 to 2037-12-05 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 254 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Transit RSA CA 1 | yes | current | 2022-12-09 to 2037-12-05 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 255 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com NAESB Client Authentication Intermediate CA ECC R1 | yes | revoked | 2018-12-17 to 2033-12-13 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 256 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com NAESB Client Authentication Intermediate CA ECC R2 | yes | current | 2019-03-07 to 2034-03-03 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 257 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com NAESB Client Authentication Intermediate CA RSA R1 | yes | current | 2018-07-06 to 2033-07-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 258 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Issuing ECC CA 1 | yes | current | 2022-12-09 to 2032-12-06 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 259 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Issuing RSA CA 1 | yes | current | 2022-12-09 to 2032-12-06 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 260 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Transit ECC CA 1 | yes | current | 2022-12-09 to 2037-12-05 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 261 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Transit RSA CA 1 | yes | current | 2022-12-09 to 2037-12-05 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 262 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC | yes | current | 2026-01-15 to 2034-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 263 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC | yes | current | 2019-02-14 to 2027-02-12 | 2.5.29.32.0 | - | - | clean |
| 264 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC | yes | current | 2026-01-15 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 265 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA | yes | current | 2026-01-15 to 2034-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 266 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA | yes | current | 2025-12-17 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 267 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com RSA SSL subCA | yes | current | 2016-02-12 to 2031-02-12 | 2.5.29.32.0 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 268 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Issuing ECC CA R1 | yes | current | 2022-10-21 to 2032-10-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 269 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Issuing RSA CA R1 | yes | current | 2022-10-21 to 2032-10-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 270 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit ECC CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection | clean |
| 271 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit RSA CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, E-mail Protection | clean |
| 272 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com SecureTrust TLS Issuing RSA CA R1 | yes | revoked | 2026-01-15 to 2029-12-30 | 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 273 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com SecureTrust TLS OV Issuing RSA CA R2 | yes | current | 2026-01-29 to 2029-12-28 | 2.23.140.1.2.2, 1.3.6.1.4.1.38064.1.3.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 274 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1 | yes | current | 2019-03-26 to 2034-03-22 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 275 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Intermediate CA ECC R2 | yes | current | 2019-03-07 to 2034-03-03 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 276 | countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Timestamping Issuing RSA CA R1 | yes | current | 2019-11-13 to 2034-11-12 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 277 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | current | 2025-02-18 to 2040-02-15 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 278 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | current | 2026-02-16 to 2042-08-21 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 279 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | current | 2023-11-07 to 2038-11-03 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 280 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | current | 2025-12-17 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 281 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | current | 2026-01-15 to 2034-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 282 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022 | yes | current | 2026-02-16 to 2042-08-21 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 2 |
| 283 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Issuing ECC CA R2 | yes | current | 2022-10-21 to 2032-10-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 284 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Issuing RSA CA R1 | yes | current | 2022-10-21 to 2032-10-18 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 285 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | current | 2023-11-07 to 2038-11-03 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 286 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | current | 2025-12-17 to 2029-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 287 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | current | 2026-02-16 to 2029-12-28 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 288 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | current | 2026-01-15 to 2034-12-30 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 289 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | current | 2025-02-18 to 2040-02-15 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 290 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022 | yes | current | 2026-02-16 to 2042-08-21 | 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6 | - | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 291 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 292 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2 | yes | current | 2022-10-21 to 2037-10-17 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 293 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC Issuing ECC CA 1 | yes | current | 2024-03-26 to 2034-03-24 | 2.5.29.32.0 | 0 | Brand Indicator for Message Identification | clean |
| 294 | countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC Issuing RSA CA 1 | yes | current | 2024-03-26 to 2034-03-24 | 2.5.29.32.0 | 0 | Brand Indicator for Message Identification | clean |
| 295 | countryName=US, organizationName=Staclar, Inc., commonName=Staclar Secure Identity CA R1 | yes | current | 2023-04-24 to 2033-04-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 296 | countryName=US, stateOrProvinceName=Delaware, localityName=Claymont, organizationName=Staclar, Inc., commonName=Staclar TLS Issuing CA R1 | yes | current | 2021-06-23 to 2031-06-21 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 297 | countryName=US, organizationName=SSL Corporation, commonName=Staclar TLS Issuing RSA CA 2 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 298 | countryName=US, organizationName=SSL Corporation, commonName=SwissNS TLS Issuing RSA CA 2 | yes | current | 2026-05-22 to 2036-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 299 | countryName=CH, stateOrProvinceName=Luzern, localityName=Luzern, organizationName=swissns GmbH, commonName=SwissNS TLS Issuing RSA CA R1 | yes | current | 2020-10-06 to 2030-10-04 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 300 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=TLS ECC ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 301 | countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=TLS RSA ICA R1 | yes | revoked | 2019-12-05 to 2029-12-02 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 302 | countryName=US, organizationName=SSL Corp, commonName=TrustSafe TLS ECC SubCA 2 | yes | current | 2026-06-12 to 2036-06-09 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 303 | countryName=TR, organizationName=Isimtescil Bilisim A.S., commonName=TrustSafe TLS ECC SubCA R1 | yes | current | 2022-03-04 to 2032-02-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 304 | countryName=US, organizationName=SSL Corp, commonName=TrustSafe TLS RSA SubCA 2 | yes | current | 2026-06-12 to 2036-06-09 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 305 | countryName=TR, organizationName=Isimtescil Bilisim A.S., commonName=TrustSafe TLS RSA SubCA R1 | yes | current | 2022-03-04 to 2032-02-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 306 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Client Authentication Certification Authority | yes | revoked, expired | 2009-06-24 to 2019-06-22 | 1.3.6.1.4.1.30360.3.3.3.5.4.6.3 | - | - | historical errors: 1 |
| 307 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Client Authentication SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2014-10-01 to 2024-09-28 | 1.3.6.1.4.1.30360.3.3.3.5.4.6.3 | 0 | TLS Web Client Authentication | historical errors: 1 |
| 308 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Code Signing CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2008-05-07 to 2028-05-07 | 1.3.6.1.4.1.30360.3.3.3.4.4.3.3 | - | - | historical errors: 2 |
| 309 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Code Signing CA, Level 2, emailAddress=ca@trustwave.com | yes | revoked | 2008-12-22 to 2028-12-22 | 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.3.4 | - | - | historical errors: 2 |
| 310 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Code Signing SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | expired | 2016-09-01 to 2024-09-29 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 311 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Domain Validation CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2010-10-14 to 2028-12-28 | 1.3.6.1.4.1.30360.3.3.3.3.4.5.3 | - | - | historical errors: 2 |
| 312 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Domain Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2016-09-01 to 2024-09-29 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 313 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Domain Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2014-10-01 to 2024-09-28 | 1.3.6.1.4.1.30360.3.3.3.3.4.5.3 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 314 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise CA | yes | unknown | 2010-03-30 to 2029-12-31 | 1.3.6.1.4.1.30360.3.6.3 | 1 | - | current errors: 1 |
| 315 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise CA | yes | unknown | 2010-04-09 to 2029-12-30 | 1.3.6.1.4.1.30360.3.6.3 | 1 | - | current errors: 1 |
| 316 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise VPN CA | yes | unknown | 2010-03-30 to 2029-12-31 | 1.3.6.1.4.1.30360.3.6.4.3.3 | 0 | - | current errors: 1 |
| 317 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2008-05-07 to 2028-05-07 | 1.3.6.1.4.1.30360.3.3.3.3.4.3.3 | - | - | historical errors: 2 |
| 318 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation CA, Level 2, emailAddress=ca@trustwave.com | yes | revoked | 2008-12-22 to 2028-12-22 | 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3 | - | - | historical errors: 2 |
| 319 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation CA, Level 3, emailAddress=ca@trustwave.com | yes | revoked | 2012-09-27 to 2027-09-24 | 1.3.6.1.4.1.30360.3.0, 2.16.840.1.114404.1.1.2.4.1, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3 | - | - | historical errors: 4 |
| 320 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2016-09-01 to 2024-09-29 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 321 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2014-10-01 to 2024-09-28 | 1.3.6.1.4.1.30360.3.3.3.3.4.3.3 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 322 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2014-10-13 to 2024-10-10 | 1.3.6.1.4.1.30360.3.0, 2.16.840.1.114404.1.1.2.4.1, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 323 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority | yes | revoked | 2025-03-03 to 2029-12-17 | 2.5.29.32.0 | 0 | Any Extended Key Usage | clean |
| 324 | commonName=Trustwave Global Client CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 325 | commonName=Trustwave Global Code Signing CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2042-08-21 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 326 | commonName=Trustwave Global Domain Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 327 | commonName=Trustwave Global ECDSA P-256 Client CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 328 | commonName=Trustwave Global ECDSA P-256 Code Signing CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2042-08-21 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 329 | commonName=Trustwave Global ECDSA P-256 Domain Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 330 | commonName=Trustwave Global ECDSA P-256 Extended Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 331 | commonName=Trustwave Global ECDSA P-256 Organization Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 332 | commonName=Trustwave Global ECDSA P-256 Timestamping CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2042-08-21 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 333 | commonName=Trustwave Global ECDSA P-384 Client CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 334 | commonName=Trustwave Global ECDSA P-384 Code Signing CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2042-08-21 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 335 | commonName=Trustwave Global ECDSA P-384 Domain Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 336 | commonName=Trustwave Global ECDSA P-384 Extended Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 337 | commonName=Trustwave Global ECDSA P-384 Organization Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 338 | commonName=Trustwave Global ECDSA P-384 Timestamping CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2042-08-21 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 339 | commonName=Trustwave Global Extended Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 340 | commonName=Trustwave Global Organization Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2028-02-24 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 341 | commonName=Trustwave Global Timestamping CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US | yes | revoked | 2018-02-06 to 2042-08-21 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 342 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2008-05-07 to 2028-05-07 | 1.3.6.1.4.1.30360.3.3.3.4.4.4.3 | - | - | historical errors: 2 |
| 343 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 2, emailAddress=ca@trustwave.com | yes | revoked | 2008-12-22 to 2028-12-22 | 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.4.3 | - | - | historical errors: 2 |
| 344 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2008-05-07 to 2028-05-07 | 1.3.6.1.4.1.30360.3.3.3.3.4.4.3 | - | - | historical errors: 2 |
| 345 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation CA, Level 2, emailAddress=ca@trustwave.com | yes | revoked | 2008-12-22 to 2028-12-22 | 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.3.4.4.3 | - | - | historical errors: 2 |
| 346 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2014-10-01 to 2024-09-28 | 1.3.6.1.4.1.30360.3.3.3.3.4.4.3 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 347 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked, expired | 2016-09-01 to 2024-09-29 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 348 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave S/MIME CA, Level 2, emailAddress=ca@trustwave.com | yes | revoked | 2008-12-22 to 2028-12-22 | 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.5.4.3.3 | - | - | historical errors: 2 |
| 349 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave S/MIME SHA256 CA, Level 1, emailAddress=ca@trustwave.com | yes | expired | 2014-10-01 to 2024-09-28 | 1.3.6.1.4.1.30360.3.3.3.5.4.3.3 | 0 | E-mail Protection | historical errors: 1 |
| 350 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Secure E-mail CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2008-05-07 to 2028-05-07 | 1.3.6.1.4.1.30360.3.3.3.5.4.3.3 | - | - | historical errors: 2 |
| 351 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Secure Global Extended Validation CA, Level 1, emailAddress=ca@trustwave.com | yes | expired | 2015-08-12 to 2025-08-09 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 352 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Special Use CA, Level 1, emailAddress=ca@trustwave.com | yes | revoked | 2008-05-07 to 2028-05-07 | 1.3.6.1.4.1.30360.3.3.3.4.4.5.3 | - | - | historical errors: 2 |
| 353 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Special Use CA, Level 2, emailAddress=ca@trustwave.com | yes | revoked | 2008-12-22 to 2028-12-22 | 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.5.3 | - | - | historical errors: 2 |
| 354 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Timestamping CA, Level 1 | yes | revoked | 2017-01-25 to 2034-12-25 | 1.3.6.1.4.1.30360.3.3.3.3.4.8.3 | 0 | Time Stamping | clean |
| 355 | countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave XRamp Global Extended Validation CA, Level 1, emailAddress=ca@trustwave.com | yes | expired | 2015-08-12 to 2025-08-09 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 356 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Client Authentication CA, Level 1 | yes | revoked | 2022-06-09 to 2029-12-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 357 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Domain Validation CA, Level 1 | yes | revoked | 2022-06-09 to 2029-12-15 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 358 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Extended Validation CA, Level 1 | yes | revoked | 2022-06-09 to 2029-12-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 359 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Organization Validation CA, Level 1 | yes | revoked | 2022-06-09 to 2029-12-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 360 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Secure Email CA, Level 1 | yes | revoked | 2022-06-09 to 2032-06-09 | 2.5.29.32.0 | 0 | E-mail Protection | clean |
| 361 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud TWG Code Signing CA, Level 1 | yes | revoked | 2022-08-10 to 2032-08-10 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 362 | countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud TWG Timestamping CA, Level 1 | yes | revoked | 2022-08-10 to 2037-08-10 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 363 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud SG TLS EV CA, Level 1 | yes | revoked | 2025-02-26 to 2029-12-22 | 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 364 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS DV CA, Level 1 | yes | revoked | 2024-08-28 to 2034-08-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 365 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS DV CA, Level 2 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 366 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS EV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 367 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS IV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.3 | 0 | TLS Web Server Authentication | clean |
| 368 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS OV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 369 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 DV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 370 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 EV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 371 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 IV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.3 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 372 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 OV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 373 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 DV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 374 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 EV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 375 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 IV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.3 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 376 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 OV CA, Level 1 | yes | revoked | 2025-02-26 to 2035-02-24 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 377 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud XG Secure Email CA, Level 1 | yes | revoked | 2024-08-28 to 2034-08-28 | 2.23.140.1.5 | 0 | E-mail Protection | clean |
| 378 | countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud XG TLS EV CA, Level 1 | yes | revoked | 2025-02-26 to 2034-02-24 | 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 379 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus Code Signing RSA CA 1 | yes | current | 2025-05-07 to 2033-05-05 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 380 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus Document Signing RSA CA 1 | yes | current | 2025-05-07 to 2033-05-05 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36 | clean |
| 381 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus Document Signing RSA CA 2 | yes | current | 2025-05-28 to 2033-05-26 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36 | clean |
| 382 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus DV TLS ECC CA 1 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 383 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus EV TLS ECC CA 1 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 384 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus OV TLS ECC CA 1 | yes | current | 2025-05-07 to 2035-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | current errors: 1 |
| 385 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus S/MIME RSA CA 1 | yes | current | 2025-05-07 to 2033-05-05 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |

## Certificate Details

### Secure Global CA

- Subject: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Serial: 075622A4E8D48A894DF413C8F0F8EAA5
- SHA-256: 4200F5043AC8590EBB527D209ED1503029FBCBD41CA1B506EC27F15ADE7DAC69
- SPKI SHA-256: 2596904DC4D699AE20C2CEF4DCE47F285937D77464AC370746F52DEA76BA0C28
- Validity: 2006-11-07 to 2029-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/SGCA.crl
- Revocation status: -
- Browser status: {"apple":"Blocked","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:56:22:a4:e8:d4:8a:89:4d:f4:13:c8:f0:f8:ea:a5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Validity
            Not Before: Nov  7 19:42:28 2006 GMT
            Not After : Dec 31 19:52:06 2029 GMT
        Subject: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.20.2:
                ...C.A
            X509v3 Key Usage:
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/SGCA.crl
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4200F5043AC8590EBB527D209ED1503029FBCBD41CA1B506EC27F15ADE7DAC69
    SPKI SHA256: 2596904DC4D699AE20C2CEF4DCE47F285937D77464AC370746F52DEA76BA0C28
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_root_ca_key_usage_must_be_critical: 
- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### SecureTrust CA

- Subject: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 0CF08E5C0816A5AD427FF0EB271859D0
- SHA-256: F1C1B50AE5A20DD8030EC9F6BC24823DD367B5255759B4E71B61FCE9F7375D73
- SPKI SHA-256: 77290717614B25F12964EBDB38B5F83CAADC0F6C36B0777F880FC6DEE1D339CC
- Validity: 2006-11-07 to 2029-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STCA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:f0:8e:5c:08:16:a5:ad:42:7f:f0:eb:27:18:59:d0
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Nov  7 19:31:18 2006 GMT
            Not After : Dec 31 19:40:55 2029 GMT
        Subject: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.20.2:
                ...C.A
            X509v3 Key Usage:
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/STCA.crl
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F1C1B50AE5A20DD8030EC9F6BC24823DD367B5255759B4E71B61FCE9F7375D73
    SPKI SHA256: 77290717614B25F12964EBDB38B5F83CAADC0F6C36B0777F880FC6DEE1D339CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_root_ca_key_usage_must_be_critical: 
- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### SSL.com Client ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022
- Serial: 76F8481EAEF03C701FE03F25540183D5
- SHA-256: AD7DD58D03AEDB22A30B5084394920CE12230C2D8017AD9B81AB04079BDD026B
- SPKI SHA-256: 4C3432C984C66AE2A754743983CA8969E2F10F4086384DC38B8060532CB0BEA7
- Validity: 2022-08-25 to 2046-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5b5a316b-6fe4-4449-a18d-8585bb0c113e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:f8:48:1e:ae:f0:3c:70:1f:e0:3f:25:54:01:83:d5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client ECC Root CA 2022
        Validity
            Not Before: Aug 25 16:30:32 2022 GMT
            Not After : Aug 19 16:30:31 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Client ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                B7:FE:2D:62:C5:81:53:CD:52:1A:2F:5D:60:A0:C3:5D:FB:B2:1C:1C
            X509v3 Subject Key Identifier:
                B7:FE:2D:62:C5:81:53:CD:52:1A:2F:5D:60:A0:C3:5D:FB:B2:1C:1C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AD7DD58D03AEDB22A30B5084394920CE12230C2D8017AD9B81AB04079BDD026B
    SPKI SHA256: 4C3432C984C66AE2A754743983CA8969E2F10F4086384DC38B8060532CB0BEA7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Client RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022
- Serial: 76AFEE88931545B650539B809CA4DF9A
- SHA-256: 1D4CA4A2AB21D0093659804FC0EB2175A617279B56A2475245C9517AFEB59153
- SPKI SHA-256: 3A0EC54C1832A281DC3062267FD937429008E1C841B37B4A79AB1BDD4CBA57FF
- Validity: 2022-08-25 to 2046-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=5b5a316b-6fe4-4449-a18d-8585bb0c113e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:af:ee:88:93:15:45:b6:50:53:9b:80:9c:a4:df:9a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client RSA Root CA 2022
        Validity
            Not Before: Aug 25 16:31:07 2022 GMT
            Not After : Aug 19 16:31:06 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Client RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F0:38:42:94:34:A9:3C:00:7F:52:EE:39:A5:F7:4B:0D:BC:6A:7D:23
            X509v3 Subject Key Identifier:
                F0:38:42:94:34:A9:3C:00:7F:52:EE:39:A5:F7:4B:0D:BC:6A:7D:23
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1D4CA4A2AB21D0093659804FC0EB2175A617279B56A2475245C9517AFEB59153
    SPKI SHA256: 3A0EC54C1832A281DC3062267FD937429008E1C841B37B4A79AB1BDD4CBA57FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Code Signing ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing ECC Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing ECC Root CA 2022
- Serial: 6E8EE45B104CC90C7EB4D8888FE5EC64
- SHA-256: E17DB396AFC136FF1D6DCDA4BB443DA2D817131855BE1C4B6FECEA221036722A
- SPKI SHA-256: 272E471DADED5C939599BE3F826DE3B8FDC5343562949B2F6D513C6526BE3B66
- Validity: 2022-08-25 to 2046-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-ECC.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:8e:e4:5b:10:4c:c9:0c:7e:b4:d8:88:8f:e5:ec:64
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Code Signing ECC Root CA 2022
        Validity
            Not Before: Aug 25 16:31:35 2022 GMT
            Not After : Aug 19 16:31:34 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Code Signing ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                58:5E:16:C3:2D:B3:E6:EA:A3:49:B3:A5:BE:D6:DE:AE:79:95:6B:8D
            X509v3 Subject Key Identifier:
                58:5E:16:C3:2D:B3:E6:EA:A3:49:B3:A5:BE:D6:DE:AE:79:95:6B:8D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E17DB396AFC136FF1D6DCDA4BB443DA2D817131855BE1C4B6FECEA221036722A
    SPKI SHA256: 272E471DADED5C939599BE3F826DE3B8FDC5343562949B2F6D513C6526BE3B66
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Code Signing RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing RSA Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing RSA Root CA 2022
- Serial: 1097C49C8C254328BBA6E8B99BAB4FA1
- SHA-256: 253E3CA36E37E867EE68867B997B9EC724DCC3161063AB0393B54F2BB7B6C315
- SPKI SHA-256: A828D6F2E0162F2E43463C1E97C1315510CACA765AE2E6E53FD3EABBD2E1AD00
- Validity: 2022-08-25 to 2046-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-RSA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:97:c4:9c:8c:25:43:28:bb:a6:e8:b9:9b:ab:4f:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Code Signing RSA Root CA 2022
        Validity
            Not Before: Aug 25 16:32:08 2022 GMT
            Not After : Aug 19 16:32:07 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Code Signing RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                C7:F6:C8:0B:62:ED:14:0C:A3:17:B6:AA:B9:1E:D1:E0:83:56:A1:5D
            X509v3 Subject Key Identifier:
                C7:F6:C8:0B:62:ED:14:0C:A3:17:B6:AA:B9:1E:D1:E0:83:56:A1:5D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 253E3CA36E37E867EE68867B997B9EC724DCC3161063AB0393B54F2BB7B6C315
    SPKI SHA256: A828D6F2E0162F2E43463C1E97C1315510CACA765AE2E6E53FD3EABBD2E1AD00
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Document Signing ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing ECC Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing ECC Root CA 2022
- Serial: 5A88B596192224E56A90CA0BBAD83A2B
- SHA-256: 5ECE6AB27131FB58A887E94177D55BD9E51AAA2DED6C081B54A39BE3CB84E1F1
- SPKI SHA-256: FE1DE8CDFB892F6986ECF504CCF08CBB0D88704C79976757484AC9DD52B940F3
- Validity: 2022-08-25 to 2046-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-ECC.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:88:b5:96:19:22:24:e5:6a:90:ca:0b:ba:d8:3a:2b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing ECC Root CA 2022
        Validity
            Not Before: Aug 25 16:32:44 2022 GMT
            Not After : Aug 19 16:32:43 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Document Signing ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                32:FB:D5:9B:CB:6D:9C:FD:81:AE:13:7D:DA:0C:C3:34:F5:3A:4D:35
            X509v3 Subject Key Identifier:
                32:FB:D5:9B:CB:6D:9C:FD:81:AE:13:7D:DA:0C:C3:34:F5:3A:4D:35
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5ECE6AB27131FB58A887E94177D55BD9E51AAA2DED6C081B54A39BE3CB84E1F1
    SPKI SHA256: FE1DE8CDFB892F6986ECF504CCF08CBB0D88704C79976757484AC9DD52B940F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Document Signing RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing RSA Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing RSA Root CA 2022
- Serial: 50D0D50DADDD017E55D169903BD21F46
- SHA-256: E807D49A859ABBC861C72CA907D443AD0FE87EAB9D99B913F2CB5B4AADABE641
- SPKI SHA-256: 593848D410013852CC6D4B692083506E985A3B9D604B876A6191B18FAC273FF3
- Validity: 2022-08-25 to 2046-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-RSA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:d0:d5:0d:ad:dd:01:7e:55:d1:69:90:3b:d2:1f:46
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing RSA Root CA 2022
        Validity
            Not Before: Aug 25 16:33:18 2022 GMT
            Not After : Aug 19 16:33:17 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Document Signing RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                04:C6:1E:79:62:8C:9A:D0:A7:84:B3:7B:77:9B:B1:C0:86:F3:48:1F
            X509v3 Subject Key Identifier:
                04:C6:1E:79:62:8C:9A:D0:A7:84:B3:7B:77:9B:B1:C0:86:F3:48:1F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E807D49A859ABBC861C72CA907D443AD0FE87EAB9D99B913F2CB5B4AADABE641
    SPKI SHA256: 593848D410013852CC6D4B692083506E985A3B9D604B876A6191B18FAC273FF3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com EV Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 2C299C5B16ED0595
- SHA-256: 22A2C1F7BDED704CC1E701B5F408C310880FE956B5DE2A4A44F99C873A25A7C8
- SPKI SHA-256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
- Validity: 2016-02-12 to 2041-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3182246526754555285 (0x2c299c5b16ed0595)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Feb 12 18:15:23 2016 GMT
            Not After : Feb 12 18:15:23 2041 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 22A2C1F7BDED704CC1E701B5F408C310880FE956B5DE2A4A44F99C873A25A7C8
    SPKI SHA256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com EV Root Certification Authority RSA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA
- Serial: 1D6C11EB6FDA399D
- SHA-256: 5ADFA25013BED3710831572DE51C4B9A21171C00313249C4CB4719D37FBB8D20
- SPKI SHA-256: 42A807CEC5AE9C0F03B40CA043AC70468B5219BD75CC5BBEA51D921DD100156F
- Validity: 2016-02-12 to 2041-02-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8834602, https://bugzilla.mozilla.org/attachment.cgi?id=8834601, https://bugzilla.mozilla.org/attachment.cgi?id=8834599
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2120089227476220317 (0x1d6c11eb6fda399d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA
        Validity
            Not Before: Feb 12 17:50:48 2016 GMT
            Not After : Feb 12 17:50:48 2041 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D9:5A:2A:FF:A5:CE:9D:A1:91:7D:FF:87:5D:AB:6A:35:12:D9:C9:4C
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                D9:5A:2A:FF:A5:CE:9D:A1:91:7D:FF:87:5D:AB:6A:35:12:D9:C9:4C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5ADFA25013BED3710831572DE51C4B9A21171C00313249C4CB4719D37FBB8D20
    SPKI SHA256: 42A807CEC5AE9C0F03B40CA043AC70468B5219BD75CC5BBEA51D921DD100156F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com EV Root Certification Authority RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 56B629CD34BC78F6
- SHA-256: 2E7BF16CC22485A7BBE2AA8696750761B0AE39BE3B2FE9D0CC6D4EF73491425C
- SPKI SHA-256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
- Validity: 2017-05-31 to 2042-05-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6248227494352943350 (0x56b629cd34bc78f6)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: May 31 18:14:37 2017 GMT
            Not After : May 30 18:14:37 2042 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Subject Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E7BF16CC22485A7BBE2AA8696750761B0AE39BE3B2FE9D0CC6D4EF73491425C
    SPKI SHA256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 75E6DFCBC1685BA8
- SHA-256: 3417BB06CC6007DA1B961C920B8AB4CE3FAD820E4AA30B9ACBC4A74EBDCEBC65
- SPKI SHA-256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
- Validity: 2016-02-12 to 2041-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8495723813297216424 (0x75e6dfcbc1685ba8)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 12 18:14:03 2016 GMT
            Not After : Feb 12 18:14:03 2041 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 3417BB06CC6007DA1B961C920B8AB4CE3FAD820E4AA30B9ACBC4A74EBDCEBC65
    SPKI SHA256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com Root Certification Authority RSA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 7B2C9BD316803299
- SHA-256: 85666A562EE0BE5CE925C1D8890A6F76A87EC16D4D7D5F29EA7419CF20123B69
- SPKI SHA-256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
- Validity: 2016-02-12 to 2041-02-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8875640296558310041 (0x7b2c9bd316803299)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 12 17:39:39 2016 GMT
            Not After : Feb 12 17:39:39 2041 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 85666A562EE0BE5CE925C1D8890A6F76A87EC16D4D7D5F29EA7419CF20123B69
    SPKI SHA256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 1403F5ABFB378B17405BE243B2A5D1C4
- SHA-256: C32FFD9F46F936D16C3673990959434B9AD60AAFBB9E7CF33654F144CC1BA143
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2022-08-25 to 2046-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:03:f5:ab:fb:37:8b:17:40:5b:e2:43:b2:a5:d1:c4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Aug 25 16:33:48 2022 GMT
            Not After : Aug 19 16:33:47 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C32FFD9F46F936D16C3673990959434B9AD60AAFBB9E7CF33654F144CC1BA143
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 6FBEDAAD73BD0840E28B4DBED4F75B91
- SHA-256: 8FAF7D2E2CB4709BB8E0B33666BF75A5DD45B5DE480F8EA8D4BFE6BEBC17F2ED
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2022-08-25 to 2046-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:be:da:ad:73:bd:08:40:e2:8b:4d:be:d4:f7:5b:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Aug 25 16:34:22 2022 GMT
            Not After : Aug 19 16:34:21 2046 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8FAF7D2E2CB4709BB8E0B33666BF75A5DD45B5DE480F8EA8D4BFE6BEBC17F2ED
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com VMC ECC Root CA 2024

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC ECC Root CA 2024
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC ECC Root CA 2024
- Serial: 1147C16A2D3F4AF7675D65E5C1ACAD8E
- SHA-256: 1B82E7F4910B51E3E802A493ACDC17FF58EAC8B9EB7C09B52AC6CD2EFB83598C
- SPKI SHA-256: 901777C1CD49D4BCC0C424E0E2639EA78A89C6773058F3344C2D9B1301D0E527
- Validity: 2024-02-19 to 2048-02-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbdae5e8-a9b4-4d97-89ee-717ca647fa8a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-VMC-Root-2024-ECC.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:47:c1:6a:2d:3f:4a:f7:67:5d:65:e5:c1:ac:ad:8e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com VMC ECC Root CA 2024
        Validity
            Not Before: Feb 19 16:25:30 2024 GMT
            Not After : Feb 13 16:25:29 2048 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com VMC ECC Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                25:F0:C6:2A:E4:DE:22:A6:00:2D:F1:52:B8:27:8D:A0:51:E2:A0:A5
            X509v3 Subject Key Identifier:
                25:F0:C6:2A:E4:DE:22:A6:00:2D:F1:52:B8:27:8D:A0:51:E2:A0:A5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1B82E7F4910B51E3E802A493ACDC17FF58EAC8B9EB7C09B52AC6CD2EFB83598C
    SPKI SHA256: 901777C1CD49D4BCC0C424E0E2639EA78A89C6773058F3344C2D9B1301D0E527
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com VMC RSA Root CA 2024

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC RSA Root CA 2024
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC RSA Root CA 2024
- Serial: 70946FAEBEB3CCE0D86FB876778061CB
- SHA-256: 8F9D1B7698886782A599B48510651C66A1AA0C5CA3192097BDC68534154BD30D
- SPKI SHA-256: DB5FB40A0C2242BBAD85C39F0BFC56FFB54E8DE153E94124153F62CF6985B526
- Validity: 2024-02-19 to 2048-02-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbdae5e8-a9b4-4d97-89ee-717ca647fa8a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:94:6f:ae:be:b3:cc:e0:d8:6f:b8:76:77:80:61:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com VMC RSA Root CA 2024
        Validity
            Not Before: Feb 19 16:25:51 2024 GMT
            Not After : Feb 13 16:25:50 2048 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com VMC RSA Root CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                C1:35:A2:F4:59:D9:07:76:97:FD:CA:E8:6B:77:D6:26:AE:7A:5A:FB
            X509v3 Subject Key Identifier:
                C1:35:A2:F4:59:D9:07:76:97:FD:CA:E8:6B:77:D6:26:AE:7A:5A:FB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F9D1B7698886782A599B48510651C66A1AA0C5CA3192097BDC68534154BD30D
    SPKI SHA256: DB5FB40A0C2242BBAD85C39F0BFC56FFB54E8DE153E94124153F62CF6985B526
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Trustwave Global Certification Authority

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 05F70E86DA49F346352EBAB2
- SHA-256: 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8
- SPKI SHA-256: 2E06CAE1FC20B200E6FB748557A4444BEC9317DFFF2E4151669E0F7944F0A9E0
- Validity: 2017-08-23 to 2042-08-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGCA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:f7:0e:86:da:49:f3:46:35:2e:ba:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Aug 23 19:34:12 2017 GMT
            Not After : Aug 23 19:34:12 2042 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8
    SPKI SHA256: 2E06CAE1FC20B200E6FB748557A4444BEC9317DFFF2E4151669E0F7944F0A9E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Trustwave Global ECC P256 Certification Authority

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 0D6A5F083F285C3E5195DF5D
- SHA-256: 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4
- SPKI SHA-256: 497128FC90656B87290482B223EFB72240FE9C421E79938DE5F8110CB0BE9056
- Validity: 2017-08-23 to 2042-08-23
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP256CA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:6a:5f:08:3f:28:5c:3e:51:95:df:5d
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Aug 23 19:35:10 2017 GMT
            Not After : Aug 23 19:35:10 2042 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4
    SPKI SHA256: 497128FC90656B87290482B223EFB72240FE9C421E79938DE5F8110CB0BE9056
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_incorrect_ku_encoding: KeyUsage contains an inefficient encoding wherein the number of 'unused bits' is declared to be 7, but it should be 9. Raw Bytes: [3 3 7 6 0], Raw Binary: [00000011 00000011 00000111 00000110 00000000]
- [current] error e_superfluous_ku_encoding: KeyUsage contains superfluous trailing 00 byte. Bytes: [3 3 7 6 0], Binary: [00000011 00000011 00000111 00000110 00000000]

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Trustwave Global ECC P384 Certification Authority

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 08BD85976C9927A48068473B
- SHA-256: 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097
- SPKI SHA-256: 828B0EEFF24654E8FF5841A29DD5D4E3ED30952CA43425A79283407208D39D16
- Validity: 2017-08-23 to 2042-08-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP384CA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:bd:85:97:6c:99:27:a4:80:68:47:3b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Aug 23 19:36:43 2017 GMT
            Not After : Aug 23 19:36:43 2042 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097
    SPKI SHA256: 828B0EEFF24654E8FF5841A29DD5D4E3ED30952CA43425A79283407208D39D16
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_incorrect_ku_encoding: KeyUsage contains an inefficient encoding wherein the number of 'unused bits' is declared to be 7, but it should be 9. Raw Bytes: [3 3 7 6 0], Raw Binary: [00000011 00000011 00000111 00000110 00000000]
- [current] error e_superfluous_ku_encoding: KeyUsage contains superfluous trailing 00 byte. Bytes: [3 3 7 6 0], Binary: [00000011 00000011 00000111 00000110 00000000]

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### VikingCloud TLS ECC Root 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TLS ECC Root 1
- Issuer: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TLS ECC Root 1
- Serial: 383BEA8BE2060C45B6A2B445
- SHA-256: C3C040E805CE774763501CCF47B617275215B7DBF777C58B950FD4650673F3BB
- SPKI SHA-256: 60294FED4CCF6F85C5BADA4A8308210E50F9200FF51D5EF4049A6B79AB594E6D
- Validity: 2024-02-05 to 2049-02-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf1ed8d6-80e8-4379-b180-e69c67470990, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c49a26bd-ee55-4e82-8c8d-5f93db81b55b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73f8f904-3b7f-4d60-b087-fd9ed004d4f5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=506ef1cb-cc1c-4146-a326-5e1522514f3e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCT1P3CA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:3b:ea:8b:e2:06:0c:45:b6:a2:b4:45
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = "Viking Cloud, Inc.", CN = VikingCloud TLS ECC Root 1
        Validity
            Not Before: Feb  5 17:00:07 2024 GMT
            Not After : Feb  3 17:00:07 2049 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = VikingCloud TLS ECC Root 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                FD:18:9E:2B:2E:37:48:D7:42:86:56:2F:51:7C:2C:1A:67:88:C4:D3
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C3C040E805CE774763501CCF47B617275215B7DBF777C58B950FD4650673F3BB
    SPKI SHA256: 60294FED4CCF6F85C5BADA4A8308210E50F9200FF51D5EF4049A6B79AB594E6D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### VikingCloud TLS RSA Root 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TLS RSA Root 1
- Issuer: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TLS RSA Root 1
- Serial: 4C4ABCB596B5EC6608EA2D9F2181D1E0
- SHA-256: 548D27778822346B9EEE3CB4621BDFE2DBDC50588DA68C5E3632301F8E62ECAB
- SPKI SHA-256: 95F618D24A05267CF70051B1B491CFB6F1E15B2CDDBCC4CA0A91AAF99DD46694
- Validity: 2024-02-05 to 2049-02-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=bf1ed8d6-80e8-4379-b180-e69c67470990, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c49a26bd-ee55-4e82-8c8d-5f93db81b55b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=73f8f904-3b7f-4d60-b087-fd9ed004d4f5, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=506ef1cb-cc1c-4146-a326-5e1522514f3e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCT1CA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:4a:bc:b5:96:b5:ec:66:08:ea:2d:9f:21:81:d1:e0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = "Viking Cloud, Inc.", CN = VikingCloud TLS RSA Root 1
        Validity
            Not Before: Feb  5 16:55:16 2024 GMT
            Not After : Feb  3 16:55:16 2049 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = VikingCloud TLS RSA Root 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                40:61:F3:3F:9E:3D:D9:4A:77:1B:00:57:58:B0:01:55:69:1A:65:39
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 548D27778822346B9EEE3CB4621BDFE2DBDC50588DA68C5E3632301F8E62ECAB
    SPKI SHA256: 95F618D24A05267CF70051B1B491CFB6F1E15B2CDDBCC4CA0A91AAF99DD46694
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### XRamp Global Certification Authority

- Subject: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 50946CEC18EAD59C4DD597EF758FA0AD
- SHA-256: CECDDC905099D8DADFC5B1D209B737CBE2C18CFB2C10C0FF0BCF0D3286FC1AA2
- SPKI SHA-256: 051CF9FA95E40E9B83EDAEDA6961F6168C7879C4660172479CDD51AB03CEA62B
- Validity: 2004-11-01 to 2035-01-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf; https://certs.securetrust.com/CA/VikingCloudCPS_84.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=615739d2-22bc-4adb-b374-2bf84fcb2bdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=22663e2c-00f9-45fc-afc6-1ed495e69afd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e4a822af-c093-4e92-b3ab-e209c0f9a867, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab8b9147-661d-43dd-a34f-590b1eafcb07, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=285cc4a1-9f54-45ac-8aa4-91d99e5f6bcd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=edf91fdb-450f-4a1e-9f00-93bc170c6de8
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/XGCA.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.xrampsecurity.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:94:6c:ec:18:ea:d5:9c:4d:d5:97:ef:75:8f:a0:ad
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Nov  1 17:14:04 2004 GMT
            Not After : Jan  1 05:37:19 2035 GMT
        Subject: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.20.2:
                ...C.A
            X509v3 Key Usage:
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.xrampsecurity.com/XGCA.crl
            1.3.6.1.4.1.311.21.1:
                ...
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CECDDC905099D8DADFC5B1D209B737CBE2C18CFB2C10C0FF0BCF0D3286FC1AA2
    SPKI SHA256: 051CF9FA95E40E9B83EDAEDA6961F6168C7879C4660172479CDD51AB03CEA62B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.xrampsecurity.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_root_ca_key_usage_must_be_critical: 
- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### 3CX CA RSA R1

- Subject: countryName=CY, organizationName=3CX, commonName=3CX CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 6359ABE4F9BA50565400B6661A5CA5CF
- SHA-256: 4E93BCADD5D4E95331AE362DF9C6066CCA7F942A8FDE4D3EE011DE34074F5840
- SPKI SHA-256: 6DE929EA07EA97D0399210FD409BC311CD3CEBD3E83D0D568E38485341826502
- Validity: 2022-01-12 to 2032-01-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/3CX-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:59:ab:e4:f9:ba:50:56:54:00:b6:66:1a:5c:a5:cf
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Jan 12 17:44:27 2022 GMT
            Not After : Jan 10 17:44:26 2032 GMT
        Subject: C = CY, O = 3CX, CN = 3CX CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                B7:8D:5D:A2:89:F4:C7:23:ED:6B:DD:99:E3:11:60:3B:1E:B3:39:2D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4E93BCADD5D4E95331AE362DF9C6066CCA7F942A8FDE4D3EE011DE34074F5840
    SPKI SHA256: 6DE929EA07EA97D0399210FD409BC311CD3CEBD3E83D0D568E38485341826502
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### 3CX TLS Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=3CX TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 372AF1BEC7A83CB8A1C8057F585C1B6A
- SHA-256: 1F4C5D5B87798BD6BE08B2102D186EFFED9C1E087EFB479B2ACB4F7934CC0A1B
- SPKI SHA-256: CEE03F09047D2A79A7D8AE70AC60B40BC56CEE4B2C0E7DFEEA44477D2BCA6F45
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/3CX-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            37:2a:f1:be:c7:a8:3c:b8:a1:c8:05:7f:58:5c:1b:6a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 12:59:47 2026 GMT
            Not After : May 19 12:59:46 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = 3CX TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                5D:C9:A5:C5:79:1C:1C:CB:40:92:92:F3:55:45:7A:D5:1B:D9:BE:FA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1F4C5D5B87798BD6BE08B2102D186EFFED9C1E087EFB479B2ACB4F7934CC0A1B
    SPKI SHA256: CEE03F09047D2A79A7D8AE70AC60B40BC56CEE4B2C0E7DFEEA44477D2BCA6F45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### AnsonNet TLS Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=AnsonNet TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 475E31E756BC3FB604F2454A116A76A7
- SHA-256: DA50741B41A10B8ACBF7AA6F441E9764CE61737763C7B2DB979FFAF9DF66D705
- SPKI SHA-256: 05D1288FE7C7C76AA1E7A664628E81CE7A0B65B1F8FA40DD0EF377144AD621CF
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/AnsonNet-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:5e:31:e7:56:bc:3f:b6:04:f2:45:4a:11:6a:76:a7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 12:56:48 2026 GMT
            Not After : May 19 12:56:47 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = AnsonNet TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                17:46:99:9E:86:40:33:B9:F9:71:97:88:F6:32:6C:7C:CC:35:4B:55
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DA50741B41A10B8ACBF7AA6F441E9764CE61737763C7B2DB979FFAF9DF66D705
    SPKI SHA256: 05D1288FE7C7C76AA1E7A664628E81CE7A0B65B1F8FA40DD0EF377144AD621CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### AnsonNet TLS Issuing RSA CA R1

- Subject: countryName=GB, stateOrProvinceName=London, localityName=London, organizationName=Anson Network Limited, commonName=AnsonNet TLS Issuing RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 316824E596BCA1B114AC004AA55A4F90
- SHA-256: 92CE7EA7424B3E7A2C14C26E0D572ADBD556E05E2B2A8BD3761C695254255856
- SPKI SHA-256: 98F4A144D901529D55817B9A8886C8761FB995C63A9C6E04BF0F9DC2D8E4D3A0
- Validity: 2020-10-06 to 2030-10-04
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/AnsonNet-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:68:24:e5:96:bc:a1:b1:14:ac:00:4a:a5:5a:4f:90
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Oct  6 16:57:47 2020 GMT
            Not After : Oct  4 16:57:47 2030 GMT
        Subject: C = GB, ST = London, L = London, O = Anson Network Limited, CN = AnsonNet TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                9C:BE:D8:CB:AF:40:C9:1D:DB:2F:9D:10:AF:99:34:59:6C:12:4E:D6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 92CE7EA7424B3E7A2C14C26E0D572ADBD556E05E2B2A8BD3761C695254255856
    SPKI SHA256: 98F4A144D901529D55817B9A8886C8761FB995C63A9C6E04BF0F9DC2D8E4D3A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Blahaj Cloud TLS ECC CA 1

- Subject: countryName=US, organizationName=SSL Corp, commonName=Blahaj Cloud TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 4B5E848F28D14D4E3C1ADDA686EEFC03
- SHA-256: 572BB5C7085007AFB7B17866278AEEE73DDD6D702DD52F35EA5108198D623BD5
- SPKI SHA-256: FF32922F3976E1E55B209145142A60A06BC15F731B817D2ED9CC5781DBA97C1B
- Validity: 2026-07-09 to 2036-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Blahaj-TLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:5e:84:8f:28:d1:4d:4e:3c:1a:dd:a6:86:ee:fc:03
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: Jul  9 16:38:02 2026 GMT
            Not After : Jul  6 16:38:01 2036 GMT
        Subject: C = US, O = SSL Corp, CN = Blahaj Cloud TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                0E:38:84:BC:4E:EE:6D:92:F2:C0:A8:3C:4F:BA:80:65:C1:9C:44:AE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 572BB5C7085007AFB7B17866278AEEE73DDD6D702DD52F35EA5108198D623BD5
    SPKI SHA256: FF32922F3976E1E55B209145142A60A06BC15F731B817D2ED9CC5781DBA97C1B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=CLOUDFLARE, INC., commonName=Cloudflare TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 2C3FA2692F4113BD3B7FE5B604B49D4D
- SHA-256: 2964FD3210EA68FAA2B4A849B36243D33F74429D1B43CE019E7B154EAC7759BA
- SPKI SHA-256: 2ADD9B918339E6B3DA181158C532E5ABC00826A6A945C73578A8DA8BC1943CED
- Validity: 2023-10-31 to 2033-10-28
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-b.ssl.com/Cloudflare-TLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:3f:a2:69:2f:41:13:bd:3b:7f:e5:b6:04:b4:9d:4d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: Oct 31 17:17:49 2023 GMT
            Not After : Oct 28 17:17:48 2033 GMT
        Subject: C = US, O = "CLOUDFLARE, INC.", CN = Cloudflare TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                9C:C4:09:72:47:18:17:7B:A7:1A:89:B3:92:35:D5:E1:03:8C:FE:92
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2964FD3210EA68FAA2B4A849B36243D33F74429D1B43CE019E7B154EAC7759BA
    SPKI SHA256: 2ADD9B918339E6B3DA181158C532E5ABC00826A6A945C73578A8DA8BC1943CED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing ECC CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 55A044B2D890E1030547D8EA2C732D4B
- SHA-256: B252FE1D3ACAD4CB21ABD2E798120FCA47863C433643751C675B80198E7880D8
- SPKI SHA-256: AD109C567B1D15FD2064C64F4A9838E5A64B25942206E7BBFE57E4F96C72F8B3
- Validity: 2025-05-29 to 2035-05-27
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-b.ssl.com/9f0af631b9a06305794b42bb4b96cc43e4da7736.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:a0:44:b2:d8:90:e1:03:05:47:d8:ea:2c:73:2d:4b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: May 29 19:49:12 2025 GMT
            Not After : May 27 19:49:11 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                F9:91:BF:A0:B7:86:04:A8:ED:01:E2:84:48:CD:E7:7D:9D:74:F3:8D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B252FE1D3ACAD4CB21ABD2E798120FCA47863C433643751C675B80198E7880D8
    SPKI SHA256: AD109C567B1D15FD2064C64F4A9838E5A64B25942206E7BBFE57E4F96C72F8B3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing ECC CA 3

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 3
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 31EEE88AFB87CD9EF8336604743F9B27
- SHA-256: F15F29ABEF73AA4DD9AB754BAEAE3685BDD3874B46B525071177628685718026
- SPKI SHA-256: E38BE21734C2FA1FCBFB7387460E11B39BF8F80729CC766F23D4E77B64433469
- Validity: 2025-05-29 to 2035-05-27
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-i.ssl.com/ae801ed1c55bb579d79208b0d772acfb8cc3a208.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:ee:e8:8a:fb:87:cd:9e:f8:33:66:04:74:3f:9b:27
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: May 29 19:49:45 2025 GMT
            Not After : May 27 19:49:44 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                83:03:FD:E7:F6:F5:4A:4D:15:41:F4:ED:22:16:D3:32:0A:3E:CA:66
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F15F29ABEF73AA4DD9AB754BAEAE3685BDD3874B46B525071177628685718026
    SPKI SHA256: E38BE21734C2FA1FCBFB7387460E11B39BF8F80729CC766F23D4E77B64433469
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing ECC CA 4

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 4
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 604D12ECB70834C3A2C712BF9A8C7A89
- SHA-256: 83D843E7EA9F8CAEF195AFF939AA1B622EEC1DEB1174F879AE223302ADA0F86F
- SPKI SHA-256: 1959E38FB7D3FC16BEE5E20E834E2C6667BF0E9E6B9806B86BD40A6D66C716D0
- Validity: 2025-05-29 to 2035-05-27
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-i.ssl.com/b0438662b4dbdae7d7faff73d3f3d3e193d8bcd2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:4d:12:ec:b7:08:34:c3:a2:c7:12:bf:9a:8c:7a:89
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: May 29 19:50:15 2025 GMT
            Not After : May 27 19:50:14 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing ECC CA 4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                82:0D:CE:68:92:74:BE:64:65:7F:18:D5:B0:16:70:0E:6A:BB:80:48
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 83D843E7EA9F8CAEF195AFF939AA1B622EEC1DEB1174F879AE223302ADA0F86F
    SPKI SHA256: 1959E38FB7D3FC16BEE5E20E834E2C6667BF0E9E6B9806B86BD40A6D66C716D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=CLOUDFLARE, INC., commonName=Cloudflare TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 55DF90C93C3590950886066F8B00B36C
- SHA-256: CB89B4B505DD2FF5EDFCE618359FD6E288AD7905C2486103FF56FCD1D5DE1857
- SPKI SHA-256: FE600C99B15B6B2D04489E67AA30E0D6C62359986D2B996E31BC9CC93AC5C94B
- Validity: 2023-10-31 to 2033-10-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-b.ssl.com/Cloudflare-TLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:df:90:c9:3c:35:90:95:08:86:06:6f:8b:00:b3:6c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: Oct 31 17:18:56 2023 GMT
            Not After : Oct 28 17:18:55 2033 GMT
        Subject: C = US, O = "CLOUDFLARE, INC.", CN = Cloudflare TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                05:6D:B4:D9:C9:58:17:E1:D0:01:A7:F5:2F:20:6A:48:3D:9A:F4:17
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CB89B4B505DD2FF5EDFCE618359FD6E288AD7905C2486103FF56FCD1D5DE1857
    SPKI SHA256: FE600C99B15B6B2D04489E67AA30E0D6C62359986D2B996E31BC9CC93AC5C94B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 015AA5322A8CD5D69ABFE3FFA14EA77F
- SHA-256: E60F5416989208F160C0385779B00C3FD875AAF6201073764FCA0FF72886E597
- SPKI SHA-256: 903D9C39C16CEA178805EA468412744B31B9739FDFAF8CDA74F7A72DBB5EA6AB
- Validity: 2025-05-29 to 2035-05-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-b.ssl.com/7983580e2cb4058230cf405e6e508f45631a2bba.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:5a:a5:32:2a:8c:d5:d6:9a:bf:e3:ff:a1:4e:a7:7f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 29 19:50:43 2025 GMT
            Not After : May 27 19:50:42 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                B2:C1:22:32:D5:D9:29:15:8F:80:9B:D7:3A:6A:7D:8C:F0:F3:72:80
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E60F5416989208F160C0385779B00C3FD875AAF6201073764FCA0FF72886E597
    SPKI SHA256: 903D9C39C16CEA178805EA468412744B31B9739FDFAF8CDA74F7A72DBB5EA6AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing RSA CA 3

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing RSA CA 3
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 57E614D0F2B0AED4B2F82F801B3B7881
- SHA-256: F2EC7E0A2CF0E3550FD336CF16BAF09A71B4759DC4D98768021E8498943C7547
- SPKI SHA-256: C7C8980B720999527393107AB7A8806F5EA8BBDA381A5479F704AF4666C4A050
- Validity: 2025-05-29 to 2035-05-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-i.ssl.com/dccd06c939fe07eea567d6958ba0907f5a80f788.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:e6:14:d0:f2:b0:ae:d4:b2:f8:2f:80:1b:3b:78:81
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 29 19:51:16 2025 GMT
            Not After : May 27 19:51:15 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing RSA CA 3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                95:75:1D:16:F3:E8:43:7C:24:55:C9:C4:E0:E1:56:8E:18:A3:EC:EF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F2EC7E0A2CF0E3550FD336CF16BAF09A71B4759DC4D98768021E8498943C7547
    SPKI SHA256: C7C8980B720999527393107AB7A8806F5EA8BBDA381A5479F704AF4666C4A050
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Cloudflare TLS Issuing RSA CA 4

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing RSA CA 4
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 140F564869F08B1047D2B03F6DA11771
- SHA-256: 764FB1B1F09F44E3B103CA06483E0E5A12DCD928230DB515131A1188869293B4
- SPKI SHA-256: 8E056536C5AA09BCDA03494233614BB0772BDC3EEFB9BAFB5512654F47A7720F
- Validity: 2025-05-29 to 2035-05-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://c.cf-i.ssl.com/e8e1b12974a621cf1abd9303637d9c967d423904.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:0f:56:48:69:f0:8b:10:47:d2:b0:3f:6d:a1:17:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 29 19:51:46 2025 GMT
            Not After : May 27 19:51:45 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Cloudflare TLS Issuing RSA CA 4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                E0:CB:53:55:38:DB:7A:A5:DE:93:08:D5:C1:18:55:5C:5A:EA:AC:A1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 764FB1B1F09F44E3B103CA06483E0E5A12DCD928230DB515131A1188869293B4
    SPKI SHA256: 8E056536C5AA09BCDA03494233614BB0772BDC3EEFB9BAFB5512654F47A7720F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Code Signing ECC ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=Code Signing ECC ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 51BDD0E4D3D60F8F6EBAE2A75EE86E1E
- SHA-256: 037616326A342FC0780D4AFFB7344FF0E925D1E0FDE4782AB782F4ABD5B532B0
- SPKI SHA-256: 8D94F4767529675FAFF5B6A1630505C5FF49355A1F41E303FD906ABC23E7C4B0
- Validity: 2019-12-05 to 2029-12-02
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-codeSigning-I-ECC-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            51:bd:d0:e4:d3:d6:0f:8f:6e:ba:e2:a7:5e:e8:6e:1e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec  5 17:54:22 2019 GMT
            Not After : Dec  2 17:54:22 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = Code Signing ECC ICA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                5C:44:2E:1A:B9:CC:6A:16:96:92:68:38:6F:38:89:66:58:77:29:DD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 037616326A342FC0780D4AFFB7344FF0E925D1E0FDE4782AB782F4ABD5B532B0
    SPKI SHA256: 8D94F4767529675FAFF5B6A1630505C5FF49355A1F41E303FD906ABC23E7C4B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Code Signing RSA ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=Code Signing RSA ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 440EFE52E2E9DEB4EC7541FB979EE10C
- SHA-256: 877A06DB8BA5DA3BDA40296760778FC2AC18B918FD8DC0ECE42FAAF94E0E7E01
- SPKI SHA-256: 2B594FB784447480B3521323C4E9600E9A893C4DE79FD12636C8963911CD6C5F
- Validity: 2019-12-05 to 2029-12-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-codeSigning-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:0e:fe:52:e2:e9:de:b4:ec:75:41:fb:97:9e:e1:0c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec  5 17:45:31 2019 GMT
            Not After : Dec  2 17:45:31 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = Code Signing RSA ICA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                6E:BD:4C:14:F2:BF:31:CF:50:31:A6:D0:12:7E:E8:BF:8E:7E:F7:56
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 877A06DB8BA5DA3BDA40296760778FC2AC18B918FD8DC0ECE42FAAF94E0E7E01
    SPKI SHA256: 2B594FB784447480B3521323C4E9600E9A893C4DE79FD12636C8963911CD6C5F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Crowdstrike, Inc. OV TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Crowdstrike, Inc. OV TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 728CED8E030231BA1ED60B6501D15D5C
- SHA-256: 8D2AB0655145C4A7805CC3080D7C23451848C6864DA0BEA9FFCC87ADAB552C61
- SPKI SHA-256: F3FC232932FC62F1093907E29F2A89D6CB2779F95E05250CEA4AF2E9C55E15E6
- Validity: 2024-09-26 to 2027-09-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Crowdstrike-OVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:8c:ed:8e:03:02:31:ba:1e:d6:0b:65:01:d1:5d:5c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Sep 26 16:32:06 2024 GMT
            Not After : Sep 26 16:32:05 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = "Crowdstrike, Inc. OV TLS Issuing ECC CA 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                C7:8A:2F:90:80:9F:3E:33:62:E9:25:D4:75:36:47:CD:F2:39:FA:00
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8D2AB0655145C4A7805CC3080D7C23451848C6864DA0BEA9FFCC87ADAB552C61
    SPKI SHA256: F3FC232932FC62F1093907E29F2A89D6CB2779F95E05250CEA4AF2E9C55E15E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Crowdstrike, Inc. OV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Crowdstrike, Inc. OV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 20ADB98357B37D6B7FE541E0856CF179
- SHA-256: 8C393E57F3D03A000D57F6756A15BC7865D185ADB053103FE875562036F44D32
- SPKI SHA-256: 820C4B3B0A8D5401486C2707A87E25AF681B3B3010BF5E42EF6F1DC4C4B91553
- Validity: 2024-09-26 to 2027-09-26
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Crowdstrike-OVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:ad:b9:83:57:b3:7d:6b:7f:e5:41:e0:85:6c:f1:79
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Sep 26 16:32:25 2024 GMT
            Not After : Sep 26 16:32:24 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = "Crowdstrike, Inc. OV TLS Issuing RSA CA 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                7F:5F:20:B5:20:C0:C8:14:4B:48:89:61:1A:B6:04:69:BE:2E:C1:48
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C393E57F3D03A000D57F6756A15BC7865D185ADB053103FE875562036F44D32
    SPKI SHA256: 820C4B3B0A8D5401486C2707A87E25AF681B3B3010BF5E42EF6F1DC4C4B91553
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### docSigning RSA ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=docSigning RSA ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 7429313102872AD0AF05262066A5295B
- SHA-256: 9D61279D2232A87E108D78ABF2EBA18D24112F84B5636A2F43B39A00F1EA0078
- SPKI SHA-256: C45C952A55128E7B373236D678915319C1888A33FB1957362852609BC6D478E7
- Validity: 2019-12-05 to 2029-12-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-docSigning-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:29:31:31:02:87:2a:d0:af:05:26:20:66:a5:29:5b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec  5 17:48:53 2019 GMT
            Not After : Dec  2 17:48:53 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = docSigning RSA ICA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                2B:A1:09:E8:63:75:7A:3C:CD:28:C4:75:0C:48:05:0A:75:6D:5D:16
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9D61279D2232A87E108D78ABF2EBA18D24112F84B5636A2F43B39A00F1EA0078
    SPKI SHA256: C45C952A55128E7B373236D678915319C1888A33FB1957362852609BC6D478E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Document Signing ECC ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=Document Signing ECC ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 0522AE31DF7DFE6D9C88D4ED91DFF786
- SHA-256: 3B91C4CD67ABDF1D5272EEBB2E27A779EF02D820CE02F64B53B9DC5E786743B8
- SPKI SHA-256: 159F316A42D58D5283DE7FE9441F15F6A55BD65989B8CEC9058EAECF09771EDD
- Validity: 2019-12-05 to 2029-12-02
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-docSigning-I-ECC-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:22:ae:31:df:7d:fe:6d:9c:88:d4:ed:91:df:f7:86
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec  5 17:57:24 2019 GMT
            Not After : Dec  2 17:57:24 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = Document Signing ECC ICA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                25:21:43:58:B1:B1:20:E3:DC:47:2E:5E:C1:B8:A2:AC:F8:27:56:04
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3B91C4CD67ABDF1D5272EEBB2E27A779EF02D820CE02F64B53B9DC5E786743B8
    SPKI SHA256: 159F316A42D58D5283DE7FE9441F15F6A55BD65989B8CEC9058EAECF09771EDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign Code Signing ICA RSA R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign Code Signing ICA RSA R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z Code Signing CA RSA R1
- Serial: 3A0C99A34B34F68C9A428229327867AC
- SHA-256: 53123A367F7714A1C2C69E8594EA94FE7691037DFBE4EEA76169E9F23F254CFC
- SPKI SHA-256: F5F36B6EA8294DBAFF9EEC58F1EE838F0625F4729AEDFD4843271E7C5AF05C1A
- Validity: 2019-08-23 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-codeSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:0c:99:a3:4b:34:f6:8c:9a:42:82:29:32:78:67:ac
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z Code Signing CA RSA R1
        Validity
            Not Before: Aug 23 16:59:58 2019 GMT
            Not After : Aug 19 17:59:47 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign Code Signing ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FD:FE:E9:A2:DA:92:C0:D1:54:C8:39:00:25:27:E5:84:CE:61:18:B9
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-codeSigning-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-codeSigning-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                99:98:64:20:57:0C:94:58:FF:2E:BC:0E:A9:D8:9A:9A:7C:BE:D3:BE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 53123A367F7714A1C2C69E8594EA94FE7691037DFBE4EEA76169E9F23F254CFC
    SPKI SHA256: F5F36B6EA8294DBAFF9EEC58F1EE838F0625F4729AEDFD4843271E7C5AF05C1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-codeSigning-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign Document Signing ICA RSA R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign Document Signing ICA RSA R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z Document Signing CA RSA R1
- Serial: 46E517DFCBA970E6BF68F73761611EC1
- SHA-256: A71F55A13CF91933C96804CF8626ABFEEFF213D821377E1C79EA074184511C92
- SPKI SHA-256: 3063DCC0727442FBAB1A5CD0B7F4EC74B397544A12231DA7FCD1C7398257C375
- Validity: 2019-08-23 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-docSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-docSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:e5:17:df:cb:a9:70:e6:bf:68:f7:37:61:61:1e:c1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z Document Signing CA RSA R1
        Validity
            Not Before: Aug 23 17:02:22 2019 GMT
            Not After : Aug 19 18:01:50 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign Document Signing ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                70:70:7C:98:F8:BA:33:CA:6F:E9:6B:AD:DA:C0:B6:19:7B:DC:72:7A
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-docSigning-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-docSigning-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                37:33:E5:D6:B7:D5:C9:2E:8E:CA:AF:14:41:A8:F3:3D:63:D3:4A:DA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A71F55A13CF91933C96804CF8626ABFEEFF213D821377E1C79EA074184511C92
    SPKI SHA256: 3063DCC0727442FBAB1A5CD0B7F4EC74B397544A12231DA7FCD1C7398257C375
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-docSigning-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-docSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign EV TLS ICA ECC R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign EV TLS ICA ECC R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z EV TLS CA ECC R1
- Serial: 76BC894455CAA2A9C38C5DB03342CA74
- SHA-256: F64D0694EDAE06D18491E6E9D31C6739979A2C81A25A8E639DFD7CE8DFDB3162
- SPKI SHA-256: B9AA98435E63F37C05430C2A4B76D80EB8CAACCF34D229F372F827A28B67AD84
- Validity: 2019-08-23 to 2029-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-EV-SSL-ECC-384-R1.crl
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:bc:89:44:55:ca:a2:a9:c3:8c:5d:b0:33:42:ca:74
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z EV TLS CA ECC R1
        Validity
            Not Before: Aug 23 16:45:04 2019 GMT
            Not After : Aug 19 17:50:59 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign EV TLS ICA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                7A:60:8B:A4:69:06:77:1E:B2:CA:4E:F7:93:1B:99:69:91:D7:C5:84
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-EV-SSL-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                21:39:65:C4:04:C5:58:A3:19:F8:68:36:BF:D8:27:E1:18:E0:62:30
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F64D0694EDAE06D18491E6E9D31C6739979A2C81A25A8E639DFD7CE8DFDB3162
    SPKI SHA256: B9AA98435E63F37C05430C2A4B76D80EB8CAACCF34D229F372F827A28B67AD84
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-EV-SSL-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign EV TLS ICA RSA R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign EV TLS ICA RSA R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z EV TLS CA RSA R1
- Serial: 3E541A0184CD8FDD69762B362A0CD7FA
- SHA-256: 9DE61D4060E4CC43887182DDD5E616946AAA37B4316EE98C424490160F6C8CAA
- SPKI SHA-256: D43638DE50DBEF1949CC3BCE54FB58539246CF93C65CC2B886AC260B4B5F6293
- Validity: 2019-08-23 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-EV-SSL-RSA-4096-R1.crl
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:54:1a:01:84:cd:8f:dd:69:76:2b:36:2a:0c:d7:fa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z EV TLS CA RSA R1
        Validity
            Not Before: Aug 23 16:48:30 2019 GMT
            Not After : Aug 19 17:52:55 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign EV TLS ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                7B:2F:71:3D:F5:D1:34:E4:EF:1B:C1:74:29:CF:48:F1:34:F2:73:D9
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-EV-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                1F:BA:2F:B8:90:47:30:19:77:77:38:91:80:47:AB:F3:5A:9C:3F:54
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9DE61D4060E4CC43887182DDD5E616946AAA37B4316EE98C424490160F6C8CAA
    SPKI SHA256: D43638DE50DBEF1949CC3BCE54FB58539246CF93C65CC2B886AC260B4B5F6293
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-EV-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign SMIME ICA RSA R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign SMIME ICA RSA R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z SMIME CA RSA R1
- Serial: 3677D33B083AB40607667DC4184EFE4C
- SHA-256: CED7917E56F4246FF1907EEFF9222D7DC811D286583A1F116C5F6175A8995FB1
- SPKI SHA-256: 6905750AE2598002A98C009EAE41A0FC2C40AD960F90BDB380386423C91AD65C
- Validity: 2019-08-23 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-SMIME-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-SMIME-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:77:d3:3b:08:3a:b4:06:07:66:7d:c4:18:4e:fe:4c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z SMIME CA RSA R1
        Validity
            Not Before: Aug 23 16:51:46 2019 GMT
            Not After : Aug 19 17:54:38 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign SMIME ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F8:81:2E:DF:9B:D0:34:81:3F:25:1B:0B:1B:A1:8C:9B:2A:61:63:F6
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-SMIME-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-SMIME-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                F8:A4:6A:29:C5:12:95:87:CA:D5:4E:89:FC:47:1A:21:F3:79:8B:6A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CED7917E56F4246FF1907EEFF9222D7DC811D286583A1F116C5F6175A8995FB1
    SPKI SHA256: 6905750AE2598002A98C009EAE41A0FC2C40AD960F90BDB380386423C91AD65C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-SMIME-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-SMIME-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign TLS ICA ECC R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign TLS ICA ECC R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z TLS CA ECC R1
- Serial: 1EA06171A7217A68C3A3D2E32B96326E
- SHA-256: 53C0FC7B663439BC02BC146CA68ED2797D5CCC406A4A03370D8848380E1C2996
- SPKI SHA-256: 81FAFBDE77872836706139AA64A84AB4221433384135B56F551B84D4666249AC
- Validity: 2019-08-23 to 2029-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-SSL-ECC-384-R1.crl
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-SSL-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:a0:61:71:a7:21:7a:68:c3:a3:d2:e3:2b:96:32:6e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z TLS CA ECC R1
        Validity
            Not Before: Aug 23 16:53:48 2019 GMT
            Not After : Aug 19 17:56:10 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign TLS ICA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                BF:22:01:6D:E2:B6:B0:BD:CE:5E:96:E6:72:FE:26:00:8F:12:31:FB
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-SSL-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-SSL-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                2F:71:43:3C:8D:4A:3E:68:91:C7:CA:AD:2C:47:70:8E:F6:8E:D0:07
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 53C0FC7B663439BC02BC146CA68ED2797D5CCC406A4A03370D8848380E1C2996
    SPKI SHA256: 81FAFBDE77872836706139AA64A84AB4221433384135B56F551B84D4666249AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-SSL-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-SSL-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Dodo Sign TLS ICA RSA R1

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=Dodo Sign Ltd, commonName=Dodo Sign TLS ICA RSA R1
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z TLS CA RSA R1
- Serial: 10DC697649848F93D8491903188F817B
- SHA-256: 55844AD37B25BB4DB3FFE7DCDC39023A41B3C488A47A95FAD1FCFAD508B70285
- SPKI SHA-256: 4019E2D676B9443D745747A1A1A824F8EF26944682F243F0D601FCFEEA186136
- Validity: 2019-08-23 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DodoSign-Intermediate-SSL-RSA-4096-R1.crl
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLXYZ-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:dc:69:76:49:84:8f:93:d8:49:19:03:18:8f:81:7b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z TLS CA RSA R1
        Validity
            Not Before: Aug 23 16:56:31 2019 GMT
            Not After : Aug 19 17:58:02 2029 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = Dodo Sign Ltd, CN = Dodo Sign TLS ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                95:52:B7:58:74:BA:0F:88:17:AC:BD:5F:B8:21:19:6B:B2:F2:42:1F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLXYZ-Intermediate-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLXYZ-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                FA:73:55:5C:EE:9B:5F:66:51:7B:47:12:A5:22:26:50:9E:16:FE:EF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 55844AD37B25BB4DB3FFE7DCDC39023A41B3C488A47A95FAD1FCFAD508B70285
    SPKI SHA256: 4019E2D676B9443D745747A1A1A824F8EF26944682F243F0D601FCFEEA186136
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLXYZ-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSLXYZ-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Domain The Net Technologies Ltd CA for Code Signing

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for Code Signing
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA RSA R1
- Serial: 4E2D1D96BCC25CA3
- SHA-256: 4316A01CC5B9709DBC835CE2B55D68D584862B8F010170364270690D7DDFAB94
- SPKI SHA-256: 8C12B647FF79A6EB4445D25DF52054BE91819484A871E373FAA157BB86E93855
- Validity: 2019-01-21 to 2024-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-Intermediate-codeSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5633191242159512739 (0x4e2d1d96bcc25ca3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Jan 21 20:07:24 2019 GMT
            Not After : Jan 20 20:07:24 2024 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for Code Signing
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                66:6B:B9:D4:A0:C0:AE:88:22:35:2F:8F:9A:F3:FE:89:AF:E7:E8:7E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                D2:42:42:26:EE:3C:AD:14:4D:2A:81:2B:4F:4D:1C:BD:3B:9F:15:FC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4316A01CC5B9709DBC835CE2B55D68D584862B8F010170364270690D7DDFAB94
    SPKI SHA256: 8C12B647FF79A6EB4445D25DF52054BE91819484A871E373FAA157BB86E93855
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Domain The Net Technologies Ltd CA for Code Signing R2

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for Code Signing R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Enterprise Intermediate CA RSA R1
- Serial: 5E1B74730952B1FA3E0D4A9C50A8DABE
- SHA-256: 8C3FAB59854117BEB40466701F89CC8224196A450EB17C2F4FD88D3497EA2687
- SPKI SHA-256: B50DBC55C0812A0B6FBB2B44E8C36531D2D68E398E519D4E1E178826A68FC71D
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-Intermediate-codeSigning-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:1b:74:73:09:52:b1:fa:3e:0d:4a:9c:50:a8:da:be
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Apr  1 17:10:47 2019 GMT
            Not After : Mar 30 17:10:47 2024 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for Code Signing R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                44:FA:2E:E6:80:21:A4:46:97:0E:6A:E8:33:BC:53:11:66:4D:A9:B9
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                95:39:87:D8:AD:40:3C:AE:A5:4F:46:5E:28:41:51:5E:7F:76:42:FF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8C3FAB59854117BEB40466701F89CC8224196A450EB17C2F4FD88D3497EA2687
    SPKI SHA256: B50DBC55C0812A0B6FBB2B44E8C36531D2D68E398E519D4E1E178826A68FC71D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Domain The Net Technologies Ltd CA for Code Signing R3

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for Code Signing R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Enterprise Intermediate CA RSA R1
- Serial: 7D16DA784046EB4C7E842BC875AE8CBC
- SHA-256: 079D4C03E8B68A881341BC4BF9FC5E4333CF6A5A6D1EE3CF81F3DB76ED28D96C
- SPKI SHA-256: E1A8FF5261F940F641F04A7F55E92A66801A24E518EEF9EEEFCB6EC57339C73D
- Validity: 2023-05-26 to 2033-05-23
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crls.ssl.com/DTNT-codeSigning-I-R3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:16:da:78:40:46:eb:4c:7e:84:2b:c8:75:ae:8c:bc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Enterprise Intermediate CA RSA R1
        Validity
            Not Before: May 26 15:32:26 2023 GMT
            Not After : May 23 15:32:25 2033 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for Code Signing R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                44:FA:2E:E6:80:21:A4:46:97:0E:6A:E8:33:BC:53:11:66:4D:A9:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                4A:14:E2:16:EB:42:CC:29:22:1C:C8:31:69:EE:81:AC:A4:02:7F:36
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 079D4C03E8B68A881341BC4BF9FC5E4333CF6A5A6D1EE3CF81F3DB76ED28D96C
    SPKI SHA256: E1A8FF5261F940F641F04A7F55E92A66801A24E518EEF9EEEFCB6EC57339C73D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Domain The Net Technologies Ltd CA for EV SSL

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for EV SSL
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Enterprise Intermediate CA RSA R1
- Serial: 21316F97A5B48BA2
- SHA-256: DEEED0017F7345A09019386C6149F7535E6383F3579B895B6BFB4CF59CBAB400
- SPKI SHA-256: D73FEDAC7A38E54338B7786B27D3D7A7DB674E0A88B20EB949AF8E453A9DF2D5
- Validity: 2019-01-21 to 2024-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-Intermediate-EV-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2391815574221261730 (0x21316f97a5b48ba2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Jan 21 20:00:24 2019 GMT
            Not After : Jan 20 20:00:24 2024 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for EV SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                CE:FB:DD:92:14:30:4A:46:CB:10:D9:83:54:09:44:19:51:34:F3:AC
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                FF:EB:0E:0D:49:BA:6F:67:DA:49:C6:F5:63:AF:C9:24:B2:8E:67:68
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DEEED0017F7345A09019386C6149F7535E6383F3579B895B6BFB4CF59CBAB400
    SPKI SHA256: D73FEDAC7A38E54338B7786B27D3D7A7DB674E0A88B20EB949AF8E453A9DF2D5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Domain The Net Technologies Ltd CA for EV SSL R2

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for EV SSL R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Serial: 46979A4DE6323CF353A14C905E20FFB3
- SHA-256: 3F31DB75828DAA96E4DE5B82A0678FE2023BD5B246C3F9250CBF6718E10958F5
- SPKI SHA-256: 2E4D7D0243480BB0301CD1791EC53FA610849D4048F9E880D266C5871C5E42C4
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-Intermediate-EV-SSL-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:97:9a:4d:e6:32:3c:f3:53:a1:4c:90:5e:20:ff:b3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Validity
            Not Before: Apr  1 17:13:48 2019 GMT
            Not After : Mar 30 17:13:48 2024 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for EV SSL R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                95:BC:43:25:A4:E1:1B:EE:09:A5:46:1E:5C:3D:F3:3A:3C:02:B9:44
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3F31DB75828DAA96E4DE5B82A0678FE2023BD5B246C3F9250CBF6718E10958F5
    SPKI SHA256: 2E4D7D0243480BB0301CD1791EC53FA610849D4048F9E880D266C5871C5E42C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Domain The Net Technologies Ltd CA for EV TLS R3

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for EV TLS R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Serial: 7445CC7E67F1AC92E69DAD16A92FE0FC
- SHA-256: 0032295B0B9CB38A775AF5EC01ADBD2D3989200D8B7F5C7333CD1C061F882E32
- SPKI SHA-256: D12DBD9DB3DC3B03DD300C152576942390500E4DCFDF7A295724AD4EAFC86362
- Validity: 2023-05-26 to 2033-05-23
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-EVTLS-I-R3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:45:cc:7e:67:f1:ac:92:e6:9d:ad:16:a9:2f:e0:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Validity
            Not Before: May 26 15:36:57 2023 GMT
            Not After : May 23 15:36:56 2033 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for EV TLS R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                3D:C9:5C:43:41:2A:05:9E:5A:DD:42:2E:27:B2:2E:F3:4E:93:9F:F3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0032295B0B9CB38A775AF5EC01ADBD2D3989200D8B7F5C7333CD1C061F882E32
    SPKI SHA256: D12DBD9DB3DC3B03DD300C152576942390500E4DCFDF7A295724AD4EAFC86362
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Domain The Net Technologies Ltd CA for SSL

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for SSL
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA RSA R1
- Serial: 4FD1E22E10E534D5
- SHA-256: D680D5BEE90A02898729713A127C1A0E0C01EA44AE25FF8D69CE38161E0C355F
- SPKI SHA-256: 29A5C689663608AB951952A8CD1847910732C4624B02F6D5DC9500B2C8AEDB20
- Validity: 2019-01-21 to 2024-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-Intermediate-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5751626886608663765 (0x4fd1e22e10e534d5)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Jan 21 20:04:36 2019 GMT
            Not After : Jan 20 20:04:36 2024 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                66:6B:B9:D4:A0:C0:AE:88:22:35:2F:8F:9A:F3:FE:89:AF:E7:E8:7E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                72:4C:23:41:6A:BA:D9:75:92:CA:39:A3:34:60:BE:C1:26:1E:54:CA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D680D5BEE90A02898729713A127C1A0E0C01EA44AE25FF8D69CE38161E0C355F
    SPKI SHA256: 29A5C689663608AB951952A8CD1847910732C4624B02F6D5DC9500B2C8AEDB20
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Domain The Net Technologies Ltd CA for SSL R2

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for SSL R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 3F0D9C83672898D00343D9B527EE4A20
- SHA-256: EAE59BA2CC33281A5CDDEC50CFBFD9DD0CA5565F3CEF698C9366A10CEC087F97
- SPKI SHA-256: D4506A2F246C3FC89BC575EC5BAE0B6161937983064AC51330511EB5441A903F
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-Intermediate-SSL-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:0d:9c:83:67:28:98:d0:03:43:d9:b5:27:ee:4a:20
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Apr  1 17:17:29 2019 GMT
            Not After : Mar 30 17:17:29 2024 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for SSL R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                C5:3F:D9:AB:DB:B7:15:9E:E4:A8:80:7A:78:B8:EA:00:A2:28:C8:F5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EAE59BA2CC33281A5CDDEC50CFBFD9DD0CA5565F3CEF698C9366A10CEC087F97
    SPKI SHA256: D4506A2F246C3FC89BC575EC5BAE0B6161937983064AC51330511EB5441A903F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Domain The Net Technologies Ltd CA for TLS R3

- Subject: countryName=IL, organizationName=Domain The Net Technologies Ltd, commonName=Domain The Net Technologies Ltd CA for TLS R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 7B63CC8B29CC2E933CA3F3685E7E78B2
- SHA-256: 75585A11D7551D4EC507B8AA9EC06C06C47E40B7A5CEDD183B3C342EC7EB7A34
- SPKI SHA-256: 644CD35A43639C278F6A835D18BC9C1FA02209B765040CB450AF9064B0DB8B10
- Validity: 2023-05-26 to 2033-05-23
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-TLS-I-R3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:63:cc:8b:29:cc:2e:93:3c:a3:f3:68:5e:7e:78:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: May 26 15:34:52 2023 GMT
            Not After : May 23 15:34:51 2033 GMT
        Subject: C = IL, O = Domain The Net Technologies Ltd, CN = Domain The Net Technologies Ltd CA for TLS R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                C3:45:9C:6A:E4:FD:53:27:8D:BD:6A:B2:B2:F8:A3:E8:EA:B2:98:06
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 75585A11D7551D4EC507B8AA9EC06C06C47E40B7A5CEDD183B3C342EC7EB7A34
    SPKI SHA256: 644CD35A43639C278F6A835D18BC9C1FA02209B765040CB450AF9064B0DB8B10
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Domain The Net Technologies Ltd TLS Issuing RSA CA 4

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Domain The Net Technologies Ltd TLS Issuing RSA CA 4
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 6931AC2B0AE7AAE3C21300C6D01D324D
- SHA-256: 671BF50EE4F10825D6E24403DD20F7049F777D3FC21F67354AD193405B9B19DD
- SPKI SHA-256: EA34C3E3F3612800D0F27CC9CDDE13803042F7FAA6FEBF4FB4CC4C2A9D69F474
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/DTNT-TLS-I-R4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:31:ac:2b:0a:e7:aa:e3:c2:13:00:c6:d0:1d:32:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 13:01:51 2026 GMT
            Not After : May 19 13:01:50 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = Domain The Net Technologies Ltd TLS Issuing RSA CA 4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                F9:9D:99:D5:A3:25:AB:95:AF:6E:18:64:E9:5F:78:B6:F8:D7:A1:39
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 671BF50EE4F10825D6E24403DD20F7049F777D3FC21F67354AD193405B9B19DD
    SPKI SHA256: EA34C3E3F3612800D0F27CC9CDDE13803042F7FAA6FEBF4FB4CC4C2A9D69F474
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra EV TLS ECC CA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 2050ED42B88522A8B041C2682D71280B
- SHA-256: 7BA8F0BB49F501E9BB72E3A13708C6A933140FDC65592A37ACDE66AD07DE607E
- SPKI SHA-256: E197C98841B49EFB9676B5F25C59BB23FE5FE6418FAF3D7B37475878AF5F4C1F
- Validity: 2022-02-28 to 2032-02-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-EVTLS-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:50:ed:42:b8:85:22:a8:b0:41:c2:68:2d:71:28:0b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Feb 28 21:30:06 2022 GMT
            Not After : Feb 26 21:30:05 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra EV TLS ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                45:DF:EE:C8:E4:16:12:A3:0C:AF:46:9E:06:47:4C:57:34:BC:45:56
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7BA8F0BB49F501E9BB72E3A13708C6A933140FDC65592A37ACDE66AD07DE607E
    SPKI SHA256: E197C98841B49EFB9676B5F25C59BB23FE5FE6418FAF3D7B37475878AF5F4C1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra EV TLS ECC SubCA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS ECC SubCA R1
- Issuer: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS ECC CA R1
- Serial: 5DE144BD52A72B7569E6A946F388A3BC
- SHA-256: A36C1CC623ECF3ED899A9AC14FDD5620919858E621E6877E01EF50DA1DB6A3AB
- SPKI SHA-256: C48D38D9F4FD4EB0A39271FE3CEA793E8458CB6FCD7CDD867972FAE51A3DD3BE
- Validity: 2022-03-04 to 2032-02-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-EVTLS-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ETugra-EVTLS-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5d:e1:44:bd:52:a7:2b:75:69:e6:a9:46:f3:88:a3:bc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra EV TLS ECC CA R1
        Validity
            Not Before: Mar  4 18:00:00 2022 GMT
            Not After : Feb 26 21:30:05 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra EV TLS ECC SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                45:DF:EE:C8:E4:16:12:A3:0C:AF:46:9E:06:47:4C:57:34:BC:45:56
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-EVTLS-T-ECC-R1.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-EVTLS-T-ECC-R1.crl
            X509v3 Subject Key Identifier:
                AF:38:5A:0D:DD:88:41:93:67:D1:3B:BE:FF:8B:E3:62:A4:7F:87:60
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A36C1CC623ECF3ED899A9AC14FDD5620919858E621E6877E01EF50DA1DB6A3AB
    SPKI SHA256: C48D38D9F4FD4EB0A39271FE3CEA793E8458CB6FCD7CDD867972FAE51A3DD3BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/ETugra-EVTLS-T-ECC-R1.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-EVTLS-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E-Tugra EV TLS RSA CA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 532917D7B3593F2CF9026B1C3DA8E48E
- SHA-256: 24E7A0475697793ABF3E0DDB04D542FFE7C93CC71D19F6067144ACA89A4CA678
- SPKI SHA-256: C726F335EFB742C3FCECD1B7CE20A799D3100928BF2268498FE7FA73B3F62D58
- Validity: 2022-02-28 to 2032-02-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-EVTLS-T-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:29:17:d7:b3:59:3f:2c:f9:02:6b:1c:3d:a8:e4:8e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb 28 21:30:36 2022 GMT
            Not After : Feb 26 21:30:35 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra EV TLS RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                51:C7:71:E4:F7:98:06:F2:5A:6C:3F:A2:14:B9:A6:DE:A1:BA:89:85
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 24E7A0475697793ABF3E0DDB04D542FFE7C93CC71D19F6067144ACA89A4CA678
    SPKI SHA256: C726F335EFB742C3FCECD1B7CE20A799D3100928BF2268498FE7FA73B3F62D58
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra EV TLS RSA SubCA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS RSA SubCA R1
- Issuer: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra EV TLS RSA CA R1
- Serial: 2B0F55D4E4FC354B3A78B7B689C434CB
- SHA-256: 6762522E4B57AED0960574AB061F79EEA068C5AE3D815F50A971CEC4958A92B8
- SPKI SHA-256: 43BBE81E6AF0FA82914B0A38FB5F53FF332D3ED603EE28B111CA48752A23EBAD
- Validity: 2022-03-04 to 2032-02-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-EVTLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ETugra-EVTLS-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:0f:55:d4:e4:fc:35:4b:3a:78:b7:b6:89:c4:34:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra EV TLS RSA CA R1
        Validity
            Not Before: Mar  4 17:49:32 2022 GMT
            Not After : Feb 26 21:30:35 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra EV TLS RSA SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                51:C7:71:E4:F7:98:06:F2:5A:6C:3F:A2:14:B9:A6:DE:A1:BA:89:85
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-EVTLS-T-RSA-R1.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-EVTLS-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                61:1D:BA:E3:0C:F4:25:92:F4:05:B5:C3:23:6E:04:4C:38:51:24:9A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6762522E4B57AED0960574AB061F79EEA068C5AE3D815F50A971CEC4958A92B8
    SPKI SHA256: 43BBE81E6AF0FA82914B0A38FB5F53FF332D3ED603EE28B111CA48752A23EBAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/ETugra-EVTLS-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-EVTLS-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### E-Tugra TLS ECC CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 1FBA9EA449EB34476B1D1DF93EB5AE37
- SHA-256: 369EC927C0A23C8928841D993E1C25851F7FFFE251D8F7CFEDC58095228BDE7D
- SPKI SHA-256: 284871F632CDE2FE3D9797EE6B9483F75D395F7D01D13D3C3E8BF851CCCC3D4B
- Validity: 2026-06-12 to 2036-06-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-T-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:ba:9e:a4:49:eb:34:47:6b:1d:1d:f9:3e:b5:ae:37
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Jun 12 16:50:27 2026 GMT
            Not After : Jun  9 16:50:26 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = E-Tugra TLS ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                BE:6F:D7:65:12:68:F1:38:48:29:59:7C:7E:A0:92:0B:55:02:7B:C9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 369EC927C0A23C8928841D993E1C25851F7FFFE251D8F7CFEDC58095228BDE7D
    SPKI SHA256: 284871F632CDE2FE3D9797EE6B9483F75D395F7D01D13D3C3E8BF851CCCC3D4B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS ECC CA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 43BD37AA55BD4F6703465D9AF49699D7
- SHA-256: 108162F2B35ED71C6EA9502F94B93E9754789DDE871B2AC26CE06D47207A95CC
- SPKI SHA-256: EFB29D8BC5EBF54CC8BB9682B8F9CDDECBCFEA609D7129E91DAD95E9EF31D730
- Validity: 2022-02-28 to 2032-02-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:bd:37:aa:55:bd:4f:67:03:46:5d:9a:f4:96:99:d7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 28 21:31:01 2022 GMT
            Not After : Feb 26 21:31:00 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                70:52:6F:0E:78:6D:E2:F6:5C:E7:8A:E8:47:DD:60:70:2C:47:E4:CF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 108162F2B35ED71C6EA9502F94B93E9754789DDE871B2AC26CE06D47207A95CC
    SPKI SHA256: EFB29D8BC5EBF54CC8BB9682B8F9CDDECBCFEA609D7129E91DAD95E9EF31D730
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS ECC SubCA 2

- Subject: countryName=US, organizationName=SSL Corp, commonName=E-Tugra TLS ECC SubCA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS ECC CA 2
- Serial: 4CA5BD54191A30B89CA0DDA0BDE1AA33
- SHA-256: 320D7344AEF96B2AA62608C6E978BD10D49437A7236A78B4C75F7A9487E27A05
- SPKI SHA-256: DE3E0622B11246A50F7A4286D0B31CB3E2F0E951F0348250DF032D4562219FF6
- Validity: 2026-06-12 to 2036-06-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-I-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-E2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:a5:bd:54:19:1a:30:b8:9c:a0:dd:a0:bd:e1:aa:33
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = E-Tugra TLS ECC CA 2
        Validity
            Not Before: Jun 12 19:21:48 2026 GMT
            Not After : Jun  9 16:50:26 2036 GMT
        Subject: C = US, O = SSL Corp, CN = E-Tugra TLS ECC SubCA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                BE:6F:D7:65:12:68:F1:38:48:29:59:7C:7E:A0:92:0B:55:02:7B:C9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-E2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-E2.crl
            X509v3 Subject Key Identifier:
                80:F2:75:73:9B:66:97:72:84:CD:F7:82:07:2B:21:7C:86:38:D4:8E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 320D7344AEF96B2AA62608C6E978BD10D49437A7236A78B4C75F7A9487E27A05
    SPKI SHA256: DE3E0622B11246A50F7A4286D0B31CB3E2F0E951F0348250DF032D4562219FF6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-E2.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-E2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS ECC SubCA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS ECC SubCA R1
- Issuer: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS ECC CA R1
- Serial: 4B3591AC477931020D799301008977FE
- SHA-256: 3687AF02C49731CA34FE4FDB9B5E5E0ECACD8A206956F19AFB38203AC5F0A567
- SPKI SHA-256: 2C4A683C1227BDD3CABC19C4BE0386543EA7885D69D12C8F97C0959756266370
- Validity: 2022-03-04 to 2032-02-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:35:91:ac:47:79:31:02:0d:79:93:01:00:89:77:fe
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS ECC CA R1
        Validity
            Not Before: Mar  4 17:53:20 2022 GMT
            Not After : Feb 26 21:31:00 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS ECC SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                70:52:6F:0E:78:6D:E2:F6:5C:E7:8A:E8:47:DD:60:70:2C:47:E4:CF
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-ECC-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
            X509v3 Subject Key Identifier:
                36:28:EA:45:E1:11:24:C0:E5:0B:11:7B:A3:AC:59:99:CD:B6:61:5E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3687AF02C49731CA34FE4FDB9B5E5E0ECACD8A206956F19AFB38203AC5F0A567
    SPKI SHA256: 2C4A683C1227BDD3CABC19C4BE0386543EA7885D69D12C8F97C0959756266370
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-ECC-R1.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 12EC0ABAC13C4C6E2553C2A341747B56
- SHA-256: 9574C647736E1AF3EA347CFE7603B6456E91685E74C52AE590FC4C25AB767F99
- SPKI SHA-256: 1FD9D58872541F910A9D72A504D17955985AED6347E3C1D69C28A1D9C5001245
- Validity: 2026-06-12 to 2036-06-09
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-T-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:ec:0a:ba:c1:3c:4c:6e:25:53:c2:a3:41:74:7b:56
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Jun 12 16:51:23 2026 GMT
            Not After : Jun  9 16:51:22 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = E-Tugra TLS RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                42:AD:BB:54:53:69:E7:13:2C:A4:4F:E4:75:F9:B5:1A:0B:96:B1:BE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9574C647736E1AF3EA347CFE7603B6456E91685E74C52AE590FC4C25AB767F99
    SPKI SHA256: 1FD9D58872541F910A9D72A504D17955985AED6347E3C1D69C28A1D9C5001245
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS RSA CA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 5E07E292087313FED24165A295A01B41
- SHA-256: 586A5C9836D9FB3BE863BA765A7966D940297FEC7BDD488016C7AA1EAE1F1D51
- SPKI SHA-256: D6F7716F4EEFD02FB97C1ABA18F6A07C7BDDC99DF513BF00DAE2A38DC1E9DD9D
- Validity: 2022-02-28 to 2032-02-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:07:e2:92:08:73:13:fe:d2:41:65:a2:95:a0:1b:41
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 28 21:31:16 2022 GMT
            Not After : Feb 26 21:31:15 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                44:6F:03:0D:B5:68:92:3C:AA:6D:D2:D3:61:F9:50:88:B8:1C:40:00
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 586A5C9836D9FB3BE863BA765A7966D940297FEC7BDD488016C7AA1EAE1F1D51
    SPKI SHA256: D6F7716F4EEFD02FB97C1ABA18F6A07C7BDDC99DF513BF00DAE2A38DC1E9DD9D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS RSA SubCA 2

- Subject: countryName=US, organizationName=SSL Corp, commonName=E-Tugra TLS RSA SubCA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS RSA CA 2
- Serial: 6A13A1C63EF12AF24E9FD93B7E5CF418
- SHA-256: F135FFB286FD1951B3C71A4C22D77AEFEAAFF7A4A035628288B9B9E693707F01
- SPKI SHA-256: BDB255C9AE0F44458C227846F45919D82494194C5F32DD1BA0BFF635C89CB85F
- Validity: 2026-06-12 to 2036-06-09
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:13:a1:c6:3e:f1:2a:f2:4e:9f:d9:3b:7e:5c:f4:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = E-Tugra TLS RSA CA 2
        Validity
            Not Before: Jun 12 19:22:44 2026 GMT
            Not After : Jun  9 16:51:22 2036 GMT
        Subject: C = US, O = SSL Corp, CN = E-Tugra TLS RSA SubCA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                42:AD:BB:54:53:69:E7:13:2C:A4:4F:E4:75:F9:B5:1A:0B:96:B1:BE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-R2.crl
            X509v3 Subject Key Identifier:
                38:F7:F6:2C:FF:65:C6:8C:26:88:5A:18:EB:A3:18:AE:00:4B:5C:3C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F135FFB286FD1951B3C71A4C22D77AEFEAAFF7A4A035628288B9B9E693707F01
    SPKI SHA256: BDB255C9AE0F44458C227846F45919D82494194C5F32DD1BA0BFF635C89CB85F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-R2.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### E-Tugra TLS RSA SubCA R1

- Subject: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS RSA SubCA R1
- Issuer: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS RSA CA R1
- Serial: 721456C61F04104B5C2B0FF6002A2284
- SHA-256: 7FD28377C87C898E9094C93EA00BF107ABE11DB80B3D85E2B4A662697681235B
- SPKI SHA-256: 453E51BB8C95A40F35E11F862D7BFD99E3D9A97C007EEA73F995CBA45B96FFE3
- Validity: 2022-03-04 to 2032-02-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ETugra-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:14:56:c6:1f:04:10:4b:5c:2b:0f:f6:00:2a:22:84
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS RSA CA R1
        Validity
            Not Before: Mar  4 17:41:52 2022 GMT
            Not After : Feb 26 21:31:15 2032 GMT
        Subject: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS RSA SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                44:6F:03:0D:B5:68:92:3C:AA:6D:D2:D3:61:F9:50:88:B8:1C:40:00
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                00:38:1C:B3:17:E9:9A:E1:87:FB:BD:7C:64:6B:9B:6B:35:AC:12:99
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7FD28377C87C898E9094C93EA00BF107ABE11DB80B3D85E2B4A662697681235B
    SPKI SHA256: 453E51BB8C95A40F35E11F862D7BFD99E3D9A97C007EEA73F995CBA45B96FFE3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Entrust DV TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Entrust DV TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 574660472034B5E0824F87D0C4BEDED7
- SHA-256: 1A7BD13C77A02501E19B12D6E3CA17BE0B09B5D1AF7711C331A8C096D354D705
- SPKI SHA-256: 159B5F7D1BC0AB9E4CADA797E3C451FE23C3397E38E42814EFDDE5DA28FC135B
- Validity: 2024-08-22 to 2027-08-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Entrust-DVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:46:60:47:20:34:b5:e0:82:4f:87:d0:c4:be:de:d7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Aug 22 17:51:27 2024 GMT
            Not After : Aug 22 17:51:26 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Entrust DV TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                94:6B:4B:09:38:6C:03:1B:52:FD:11:19:71:E3:01:52:7C:D3:07:47
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1A7BD13C77A02501E19B12D6E3CA17BE0B09B5D1AF7711C331A8C096D354D705
    SPKI SHA256: 159B5F7D1BC0AB9E4CADA797E3C451FE23C3397E38E42814EFDDE5DA28FC135B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- expires_within_398_days

### Entrust DV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Entrust DV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 072FD7E1F8EA824010D549D37F6CE1CE
- SHA-256: B76136F39DE4C5BF0FDF5531D3B116D2B3E5DD3C1EB7A69EC9DB20E931B4C528
- SPKI SHA-256: 811B57B413EC9F3F1FED54E3012AC1CA365BD15F6B756A6C7342244E0E498215
- Validity: 2024-08-22 to 2027-08-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Entrust-DVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:d7:e1:f8:ea:82:40:10:d5:49:d3:7f:6c:e1:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Aug 22 17:52:23 2024 GMT
            Not After : Aug 22 17:52:22 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Entrust DV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                05:BF:78:2F:81:6C:52:EF:A6:3F:A0:CC:64:59:D9:27:83:8C:A1:3F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B76136F39DE4C5BF0FDF5531D3B116D2B3E5DD3C1EB7A69EC9DB20E931B4C528
    SPKI SHA256: 811B57B413EC9F3F1FED54E3012AC1CA365BD15F6B756A6C7342244E0E498215
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- expires_within_398_days

### Entrust EV TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Entrust EV TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 1AE42CF5AC62B72761E89C3B5D995169
- SHA-256: 90487DF9DA11848B04C9993B92EA7BEFD2EB73C5765A3C9BBAEEC3AB2E0D1440
- SPKI SHA-256: 510F3A067FF98517AB4B0FCA9513DB8E00819050133E3EEE12C3350D2995CEB2
- Validity: 2024-08-22 to 2027-08-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Entrust-EVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:e4:2c:f5:ac:62:b7:27:61:e8:9c:3b:5d:99:51:69
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Aug 22 17:54:17 2024 GMT
            Not After : Aug 22 17:54:16 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Entrust EV TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                AF:73:B8:B3:EF:5A:34:6C:62:00:47:F4:7B:FA:6B:F6:C0:41:BA:B2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 90487DF9DA11848B04C9993B92EA7BEFD2EB73C5765A3C9BBAEEC3AB2E0D1440
    SPKI SHA256: 510F3A067FF98517AB4B0FCA9513DB8E00819050133E3EEE12C3350D2995CEB2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Entrust EV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Entrust EV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 632EE520E05AFFBCCE19045824CC3678
- SHA-256: D5612C7ED743B64CD8DB432CEDFEA582608D4223F119EFACE7A6753534392AC8
- SPKI SHA-256: FACAA9CCF4004A45D5C2ACCF70BA61A55AD83981C2A2A80BEBFA81A23C720179
- Validity: 2024-08-22 to 2027-08-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Entrust-EVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:2e:e5:20:e0:5a:ff:bc:ce:19:04:58:24:cc:36:78
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Aug 22 17:54:46 2024 GMT
            Not After : Aug 22 17:54:45 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Entrust EV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                73:6C:21:C3:17:3F:B5:94:B0:7B:4A:82:49:44:90:88:CF:7E:60:44
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D5612C7ED743B64CD8DB432CEDFEA582608D4223F119EFACE7A6753534392AC8
    SPKI SHA256: FACAA9CCF4004A45D5C2ACCF70BA61A55AD83981C2A2A80BEBFA81A23C720179
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### Entrust OV TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Entrust OV TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 48C2FB641EB88630E0BD990B998FC3F2
- SHA-256: 87026A05BC3AD085A8E447C2D2864E2EBEC7D017DC488DE255CF4E5EB0576271
- SPKI SHA-256: 46A9EB14C25CA45E4ADD1A7800574BE0B41035FA210954B44578E3FD8717989E
- Validity: 2024-08-22 to 2027-08-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Entrust-OVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:c2:fb:64:1e:b8:86:30:e0:bd:99:0b:99:8f:c3:f2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Aug 22 17:53:07 2024 GMT
            Not After : Aug 22 17:53:06 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Entrust OV TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                EC:54:70:15:C2:48:58:DC:22:F1:88:44:0C:5A:10:75:BC:28:AD:9C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 87026A05BC3AD085A8E447C2D2864E2EBEC7D017DC488DE255CF4E5EB0576271
    SPKI SHA256: 46A9EB14C25CA45E4ADD1A7800574BE0B41035FA210954B44578E3FD8717989E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- expires_within_398_days

### Entrust OV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Entrust OV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 6FE63EDE5FC1C03AFB6D7A85BD3A156D
- SHA-256: 345C0CF70370A56D465B8E6ED531B55CC8EB1DA5B26880775C589A2F43358D83
- SPKI SHA-256: 8ACF74A11C5E49D2175C0F72381F30C333099251713F263E15F801D2DCFBAAFC
- Validity: 2024-08-22 to 2027-08-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Entrust-OVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:e6:3e:de:5f:c1:c0:3a:fb:6d:7a:85:bd:3a:15:6d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Aug 22 17:53:38 2024 GMT
            Not After : Aug 22 17:53:37 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Entrust OV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                68:0D:45:CA:35:C2:E7:9A:1B:F0:B3:84:DD:D5:DA:7F:0B:89:C1:11
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 345C0CF70370A56D465B8E6ED531B55CC8EB1DA5B26880775C589A2F43358D83
    SPKI SHA256: 8ACF74A11C5E49D2175C0F72381F30C333099251713F263E15F801D2DCFBAAFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- expires_within_398_days

### Euronet TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Euronet TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 676DE0C4A3B632AD02E2A44FF080CAC4
- SHA-256: 9A1570E8211DE713FCEB2DC4A7728ABE1994A33A4CA62A4F81D4F7511DE9DB50
- SPKI SHA-256: FEF72EDDB2DDAE5FB6A55D52E1C7A737BFF218C70067EAA3D73940F44C0B52AC
- Validity: 2026-04-09 to 2036-04-06
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Euronet-TLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            67:6d:e0:c4:a3:b6:32:ad:02:e2:a4:4f:f0:80:ca:c4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: Apr  9 12:59:19 2026 GMT
            Not After : Apr  6 12:59:18 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = Euronet TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                14:B8:2B:03:1C:B1:60:64:56:0D:AB:BB:40:FF:AB:61:58:92:12:2F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9A1570E8211DE713FCEB2DC4A7728ABE1994A33A4CA62A4F81D4F7511DE9DB50
    SPKI SHA256: FEF72EDDB2DDAE5FB6A55D52E1C7A737BFF218C70067EAA3D73940F44C0B52AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### EV TLS ECC ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=EV TLS ECC ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 0D355EB515E02390829AF16B4811A2FB
- SHA-256: A5F4B826A58637F912B69FE859907243BDFEAA71A02DC4429D0664E214A0A9DB
- SPKI SHA-256: 1E6F987B204F7F40A0CAA33B8C3A070E84A7F7F5BAA557E03FD4AC5C81A1E9DE
- Validity: 2019-12-05 to 2029-12-02
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-EVTLS-I-ECC-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:35:5e:b5:15:e0:23:90:82:9a:f1:6b:48:11:a2:fb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Dec  5 17:59:00 2019 GMT
            Not After : Dec  2 17:59:00 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = EV TLS ECC ICA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Subject Key Identifier:
                AF:34:D2:DA:3D:CE:02:E6:C9:1D:43:1A:BC:98:5B:27:80:D2:DA:F8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A5F4B826A58637F912B69FE859907243BDFEAA71A02DC4429D0664E214A0A9DB
    SPKI SHA256: 1E6F987B204F7F40A0CAA33B8C3A070E84A7F7F5BAA557E03FD4AC5C81A1E9DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EV TLS RSA ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=EV TLS RSA ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 5E45C2569B9D2BBD9C13CBE6E3547D01
- SHA-256: 613BC7B39C378241EE953BA1A519E8F5FE30223B0457F10CC35E30A4933BA13F
- SPKI SHA-256: 8015FDF5703434E11477AAD6C8CD929639FF4476AD4D48E7861F824D430D17D6
- Validity: 2019-12-05 to 2029-12-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-EVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:45:c2:56:9b:9d:2b:bd:9c:13:cb:e6:e3:54:7d:01
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Dec  5 17:50:48 2019 GMT
            Not After : Dec  2 17:50:48 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = EV TLS RSA ICA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                01:3D:0D:D0:71:1B:66:78:EE:65:8D:31:A6:D4:92:83:40:B7:12:9E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 613BC7B39C378241EE953BA1A519E8F5FE30223B0457F10CC35E30A4933BA13F
    SPKI SHA256: 8015FDF5703434E11477AAD6C8CD929639FF4476AD4D48E7861F824D430D17D6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EverythingLegal Document Signing Issuing RSA SubCA R1

- Subject: countryName=US, organizationName=Everything Legal, LLC, commonName=EverythingLegal Document Signing Issuing RSA SubCA R1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit RSA CA R1
- Serial: 79528EB99709C6F64742E7197014D821
- SHA-256: 7D5EC2C66B03B65BBDDEADF87F42E679B1FF5A7701AD1766FF42AFE5F60AC889
- SPKI SHA-256: EEC932EA2721BFB04D691285C002DFD54754FC174E0C0F7EBE2194D0E2F4A230
- Validity: 2022-03-28 to 2032-03-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/EverythingLegal-docSigning-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:52:8e:b9:97:09:c6:f6:47:42:e7:19:70:14:d8:21
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit RSA CA R1
        Validity
            Not Before: Mar 28 18:48:34 2022 GMT
            Not After : Mar 25 18:48:33 2032 GMT
        Subject: C = US, O = "Everything Legal, LLC", CN = EverythingLegal Document Signing Issuing RSA SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C5:7C:D2:40:1E:7F:F8:A6:12:D9:05:B9:52:DB:31:67:64:72:3B:B4
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                8A:EF:00:2E:4D:AF:AC:97:B4:3B:79:75:63:81:89:F3:7E:38:87:A0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7D5EC2C66B03B65BBDDEADF87F42E679B1FF5A7701AD1766FF42AFE5F60AC889
    SPKI SHA256: EEC932EA2721BFB04D691285C002DFD54754FC174E0C0F7EBE2194D0E2F4A230
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Health Gorilla Client Auth RSA SubCA 1

- Subject: countryName=US, organizationName=HEALTH GORILLA, INC., commonName=Health Gorilla Client Auth RSA SubCA 1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit RSA CA R1
- Serial: 1FCC4F1EB7D43094A71C16CE531EB82D
- SHA-256: FA6AEF52BC57548699D98A9A863D5903CC6C813814AB8B7C65C13577BCDD600C
- SPKI SHA-256: 8F756175B2761778536532DC84ADFF81FBD50660810C95F0D853C7BC0B5F91C9
- Validity: 2025-02-04 to 2035-02-02
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/HealthGorilla-clientAuth-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:cc:4f:1e:b7:d4:30:94:a7:1c:16:ce:53:1e:b8:2d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = SSL Corp, CN = SSL.com Client Authentication Transit RSA CA R1
        Validity
            Not Before: Feb  4 08:04:29 2025 GMT
            Not After : Feb  2 08:04:28 2035 GMT
        Subject: C = US, O = "HEALTH GORILLA, INC.", CN = Health Gorilla Client Auth RSA SubCA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                30:09:7D:12:4F:0C:0F:DE:61:8F:A8:4A:E1:6A:06:FE:AE:33:D0:5F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-clientAuth-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                91:DF:B1:62:83:6F:E4:02:AA:81:72:6D:02:90:99:2E:FB:59:87:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FA6AEF52BC57548699D98A9A863D5903CC6C813814AB8B7C65C13577BCDD600C
    SPKI SHA256: 8F756175B2761778536532DC84ADFF81FBD50660810C95F0D853C7BC0B5F91C9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-clientAuth-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### HydrantID Code Signing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=HydrantID Code Signing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing Transit ECC CA R2
- Serial: 5B77DAC7DD8549866245ACEF3C0AE27B
- SHA-256: 5AB2F5AC26D05BA1725736EEFB8628B831AA45551739F5E4A3F523198AEA7B96
- SPKI SHA-256: 0D8405DB3C4BACBBB4F6E19D1B96FD88E9E3892ED49B2C9329BE2A5C779F527B
- Validity: 2026-05-22 to 2034-05-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/HydrantID-codeSigning-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-CodeSigning-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:77:da:c7:dd:85:49:86:62:45:ac:ef:3c:0a:e2:7b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Code Signing Transit ECC CA R2
        Validity
            Not Before: May 22 13:12:45 2026 GMT
            Not After : May 20 13:12:44 2034 GMT
        Subject: C = US, O = SSL Corporation, CN = HydrantID Code Signing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C6:14:C3:07:C5:8F:B6:80:A4:94:B7:42:35:A9:16:9D:54:1E:5D:72
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-CodeSigning-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-CodeSigning-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                59:A1:7D:A1:A6:69:62:98:97:CC:93:B0:8A:86:D9:CD:9C:6C:BC:E2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5AB2F5AC26D05BA1725736EEFB8628B831AA45551739F5E4A3F523198AEA7B96
    SPKI SHA256: 0D8405DB3C4BACBBB4F6E19D1B96FD88E9E3892ED49B2C9329BE2A5C779F527B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-CodeSigning-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-CodeSigning-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### HydrantID TLS ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=HydrantID TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 64BCB5430C0C2B10FA44D9D7E3C489E6
- SHA-256: 90EB56A4A90DC5EC9E7C0C7B064FF5DE141834C13B2744C0BE153912BEC45CCE
- SPKI SHA-256: 7F5B39AD69DE25FD5AB15F2FD1A1253DEA62A043281250746016C25E6E2F3173
- Validity: 2026-05-27 to 2036-05-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/HydrantID-TLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:bc:b5:43:0c:0c:2b:10:fa:44:d9:d7:e3:c4:89:e6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: May 27 13:38:55 2026 GMT
            Not After : May 24 13:38:54 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = HydrantID TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                4D:04:6C:69:5E:E4:52:1B:0D:64:29:3A:9B:67:57:45:44:37:5D:AF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 90EB56A4A90DC5EC9E7C0C7B064FF5DE141834C13B2744C0BE153912BEC45CCE
    SPKI SHA256: 7F5B39AD69DE25FD5AB15F2FD1A1253DEA62A043281250746016C25E6E2F3173
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### InterCloud Client Certificate CA ECC

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 5E55C4F328638D02
- SHA-256: F5D65A1301C046F8AAFB2DFB09AE84ACF67571769CEB62B9B676F3688BEB28F1
- SPKI SHA-256: 0F7233E0951129A4D181C050B89E6E1B14DE48F9373672E09A55CBDD6167DCB6
- Validity: 2019-02-14 to 2029-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-ECC-384-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6797555761219341570 (0x5e55c4f328638d02)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 14 17:55:54 2019 GMT
            Not After : Feb 11 17:55:54 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                65:02:95:6A:87:E4:C5:FB:91:72:50:46:23:97:B7:7B:31:93:C8:11
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F5D65A1301C046F8AAFB2DFB09AE84ACF67571769CEB62B9B676F3688BEB28F1
    SPKI SHA256: 0F7233E0951129A4D181C050B89E6E1B14DE48F9373672E09A55CBDD6167DCB6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Client Certificate CA ECC R3

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA ECC R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 6253818575B3923EE5B449DFCAF9A62A
- SHA-256: 70AB0FA1586CDCAF616E9468AD889957DB88B2FA513260D5BFB4D718624BC9AB
- SPKI SHA-256: 140C4601B3995C6A74BFB098139B71FAA4A710C847C6B7A3FD5618734B0CF253
- Validity: 2019-03-07 to 2029-03-04
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-ECC-384-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:53:81:85:75:b3:92:3e:e5:b4:49:df:ca:f9:a6:2a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:28:46 2019 GMT
            Not After : Mar  4 19:28:46 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA ECC R3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                21:6D:0C:3D:41:3D:D0:51:94:8F:53:E3:80:2F:58:7B:8C:84:96:47
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 70AB0FA1586CDCAF616E9468AD889957DB88B2FA513260D5BFB4D718624BC9AB
    SPKI SHA256: 140C4601B3995C6A74BFB098139B71FAA4A710C847C6B7A3FD5618734B0CF253
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Client Certificate CA RSA

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 608242D4602294E9
- SHA-256: EA3D1FC6BC85D3F28A279FECD2716EDFB24801BA0A91731D9DD4F61C0005DCE0
- SPKI SHA-256: 6D36D03E19A494154DDBE300CC1FF48AC40C4406C14AFBBA82B8F2BD76263680
- Validity: 2019-02-14 to 2029-02-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6954194254526846185 (0x608242d4602294e9)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 14 17:53:40 2019 GMT
            Not After : Feb 11 17:53:40 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                82:2E:64:F2:47:D3:D7:AB:D2:CA:45:7B:08:66:8C:FA:0B:C7:E9:42
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EA3D1FC6BC85D3F28A279FECD2716EDFB24801BA0A91731D9DD4F61C0005DCE0
    SPKI SHA256: 6D36D03E19A494154DDBE300CC1FF48AC40C4406C14AFBBA82B8F2BD76263680
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Client Certificate CA RSA R3

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA RSA R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 1308111FB693E61A3C77719EDAA9CB80
- SHA-256: A04A514BB8114C03CB6BDB98172360CF0BE682E9FA11D5D8067309CED1151872
- SPKI SHA-256: 454EF3ED27F677958E8D69C097CABE9D64F31EC1BF351E678DEB30726E311705
- Validity: 2019-03-26 to 2029-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:08:11:1f:b6:93:e6:1a:3c:77:71:9e:da:a9:cb:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:14:54 2019 GMT
            Not After : Mar 23 17:14:54 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                B8:CD:CE:76:B8:65:7E:58:D1:46:63:AC:A4:BF:96:4D:BC:B8:C4:49
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A04A514BB8114C03CB6BDB98172360CF0BE682E9FA11D5D8067309CED1151872
    SPKI SHA256: 454EF3ED27F677958E8D69C097CABE9D64F31EC1BF351E678DEB30726E311705
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Code Signing Certificate CA RSA

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Code Signing Certificate CA RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 3ADF2110D945A5C4
- SHA-256: 74D34CA7D3547FB3EC955D8EEFEBC4DCF0CBB0AEF3F977E19C5721223C6E5B43
- SPKI SHA-256: 91A12A2E6BEB94DDA724236A813873724E4E1B106969ACF0C82711CF1882C1D5
- Validity: 2019-02-14 to 2029-02-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4242145730254710212 (0x3adf2110d945a5c4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 14 17:58:10 2019 GMT
            Not After : Feb 11 17:58:10 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Code Signing Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                71:AD:33:77:B2:F2:52:DA:F1:00:9E:32:21:2E:77:A2:F2:20:99:6E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74D34CA7D3547FB3EC955D8EEFEBC4DCF0CBB0AEF3F977E19C5721223C6E5B43
    SPKI SHA256: 91A12A2E6BEB94DDA724236A813873724E4E1B106969ACF0C82711CF1882C1D5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Code Signing Certificate CA RSA R3

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Code Signing Certificate CA RSA R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 672D382AE057B40FD7CF42A7D8AA9416
- SHA-256: CFF9B54D002201001B65B1EB7474A45CD1965740CBAD6AA9313C60A2F528E0F7
- SPKI SHA-256: C8064F2E4BF4A9BA3AF6101FFED0B0E6009C2F22F5AFFA24B2FF665FFC903E6E
- Validity: 2019-03-26 to 2029-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            67:2d:38:2a:e0:57:b4:0f:d7:cf:42:a7:d8:aa:94:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:18:16 2019 GMT
            Not After : Mar 23 17:18:16 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Code Signing Certificate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                BE:9B:FB:7D:4D:24:C9:3E:F0:39:B4:BE:0F:36:74:27:85:DE:B9:9D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CFF9B54D002201001B65B1EB7474A45CD1965740CBAD6AA9313C60A2F528E0F7
    SPKI SHA256: C8064F2E4BF4A9BA3AF6101FFED0B0E6009C2F22F5AFFA24B2FF665FFC903E6E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud EV SSL Certificate CA RSA

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud EV SSL Certificate CA RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 587B101261CC5DE3
- SHA-256: 1E61F80F20BA092D402CF3F46FFA242DD350363623C7714E1276798EABA140A2
- SPKI SHA-256: E768343DED4537E5FC91E85736C8B4835B45E320BDC7B9623A76E3DFB9AEE1A3
- Validity: 2019-02-14 to 2029-02-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6375707368609308131 (0x587b101261cc5de3)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb 14 18:04:17 2019 GMT
            Not After : Feb 11 18:04:17 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud EV SSL Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                34:A9:FA:20:3D:DE:3D:97:F7:C7:06:1F:47:A9:2F:31:58:16:4C:CC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1E61F80F20BA092D402CF3F46FFA242DD350363623C7714E1276798EABA140A2
    SPKI SHA256: E768343DED4537E5FC91E85736C8B4835B45E320BDC7B9623A76E3DFB9AEE1A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud EV SSL Certificate CA RSA R3

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud EV SSL Certificate CA RSA R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 46D369EDFB2DB861B3DACEA3DF2CF332
- SHA-256: E56AEEEBF288069EEC2D6E198A27E19F9DF309135068CFA9354026943D24F3B1
- SPKI SHA-256: 84F2F31BA572D607F53CC59680B63CCFF6B45B2AB23287A3F7E6EE1E9AEBA085
- Validity: 2019-03-26 to 2029-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:d3:69:ed:fb:2d:b8:61:b3:da:ce:a3:df:2c:f3:32
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Mar 26 17:22:06 2019 GMT
            Not After : Mar 23 17:22:06 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud EV SSL Certificate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                7D:80:B4:AC:03:D5:0D:0E:42:5B:B8:63:39:6E:17:F2:0F:76:8D:25
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E56AEEEBF288069EEC2D6E198A27E19F9DF309135068CFA9354026943D24F3B1
    SPKI SHA256: 84F2F31BA572D607F53CC59680B63CCFF6B45B2AB23287A3F7E6EE1E9AEBA085
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud SSL Certificate CA ECC

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 72FCE6DDD089341E
- SHA-256: A8A832362DE1DC7BB7C368E01DC617FB2FD7EAF36A97B361EA234F81241D3A75
- SPKI SHA-256: F3D233198583A1E252AB440DDE3F368F111A0CF0161398CBAFE452805BEC4BDD
- Validity: 2019-02-14 to 2029-02-11
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8285751254815683614 (0x72fce6ddd089341e)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 14 18:02:31 2019 GMT
            Not After : Feb 11 18:02:31 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                03:0B:78:78:CB:60:2A:B5:CD:E5:03:D4:F0:1A:4B:38:79:1E:99:09
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: A8A832362DE1DC7BB7C368E01DC617FB2FD7EAF36A97B361EA234F81241D3A75
    SPKI SHA256: F3D233198583A1E252AB440DDE3F368F111A0CF0161398CBAFE452805BEC4BDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud SSL Certificate CA ECC R2

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 71EB415BEEA3392CBC7BBB509E9CA166
- SHA-256: 36CDCC7C8F383F7485658466FD950E753FCB019E250FD1BC1A06C5981D8A4188
- SPKI SHA-256: 6193F02319E9958641189E9A0EF19C3075AA4A22CF9A14B026AD9D7CD749A53B
- Validity: 2019-03-07 to 2029-03-04
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-ECC-384-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:eb:41:5b:ee:a3:39:2c:bc:7b:bb:50:9e:9c:a1:66
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:30:37 2019 GMT
            Not After : Mar  4 19:30:37 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                61:3F:BA:0D:39:EF:4B:82:A3:92:43:C3:C4:21:64:9A:FE:FE:0F:BD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 36CDCC7C8F383F7485658466FD950E753FCB019E250FD1BC1A06C5981D8A4188
    SPKI SHA256: 6193F02319E9958641189E9A0EF19C3075AA4A22CF9A14B026AD9D7CD749A53B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud SSL Certificate CA RSA

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 28C932B2A07946DD
- SHA-256: 1E36D49E6E502DCEE0338137C0A8DBF60DB277433F955D6EF86D7FE774585ECD
- SPKI SHA-256: 6D083573D455381897D30B39ED16F3AD07EA1DADE93757483F61EE31EBC17FD4
- Validity: 2019-02-14 to 2029-02-11
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2938935974613829341 (0x28c932b2a07946dd)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 14 18:01:06 2019 GMT
            Not After : Feb 11 18:01:06 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                34:A0:65:F7:B0:BF:36:03:16:B9:87:5E:14:4D:89:7B:80:22:3A:8F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1E36D49E6E502DCEE0338137C0A8DBF60DB277433F955D6EF86D7FE774585ECD
    SPKI SHA256: 6D083573D455381897D30B39ED16F3AD07EA1DADE93757483F61EE31EBC17FD4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud SSL Certificate CA RSA R2

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 39742766A5958257B9BB7C164F385426
- SHA-256: 1347E97BF5B71C78DE00F2A44A9D07DF78E2E997E98E7038B7625765C97CDC47
- SPKI SHA-256: CE9DE200594A7322C032A7BE309663829C21C262EB4180E55441CD4C2722050C
- Validity: 2019-03-26 to 2029-03-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:74:27:66:a5:95:82:57:b9:bb:7c:16:4f:38:54:26
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:25:55 2019 GMT
            Not After : Mar 23 17:25:55 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                06:2F:A6:50:14:B4:9A:11:E7:74:75:8A:84:EF:CD:81:43:13:8E:1E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1347E97BF5B71C78DE00F2A44A9D07DF78E2E997E98E7038B7625765C97CDC47
    SPKI SHA256: CE9DE200594A7322C032A7BE309663829C21C262EB4180E55441CD4C2722050C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Ventures CA for ClientCert ECC

- Subject: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for ClientCert ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 1B8BB443808D135D
- SHA-256: 019D3AED2112F4A626CE24CC4DC2196DD19A010BD8B67516E7E554630510CDE2
- SPKI SHA-256: CAB01C2E352C2C66D2F8361BB749E0E38DE9AFBDD14267C1E7BEA37B8F086580
- Validity: 2019-01-16 to 2029-01-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1984878262799373149 (0x1b8bb443808d135d)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Jan 16 21:14:22 2019 GMT
            Not After : Jan 13 21:14:22 2029 GMT
        Subject: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for ClientCert ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                46:1F:63:C9:50:31:53:49:87:8C:BE:5E:9A:3D:5F:D3:CF:83:83:FE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 019D3AED2112F4A626CE24CC4DC2196DD19A010BD8B67516E7E554630510CDE2
    SPKI SHA256: CAB01C2E352C2C66D2F8361BB749E0E38DE9AFBDD14267C1E7BEA37B8F086580
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Ventures CA for ClientCert RSA

- Subject: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for ClientCert RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 09E6F7E5DC8A10BE
- SHA-256: D7C0EF80A3DAC4DA5C7E953C625555966959DCA93122F22728850BEAAF1741AF
- SPKI SHA-256: 0D5CF19504137036B145BED3869E3B4A426D5E585219ADA21E09D23E000870A6
- Validity: 2019-01-16 to 2029-01-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 713530157604409534 (0x9e6f7e5dc8a10be)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Jan 16 21:12:48 2019 GMT
            Not After : Jan 13 21:12:48 2029 GMT
        Subject: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for ClientCert RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                78:A1:D7:59:38:A9:48:6C:8A:E1:54:6C:97:80:0D:98:62:A8:A0:76
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7C0EF80A3DAC4DA5C7E953C625555966959DCA93122F22728850BEAAF1741AF
    SPKI SHA256: 0D5CF19504137036B145BED3869E3B4A426D5E585219ADA21E09D23E000870A6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Ventures CA for CodeSigning

- Subject: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for CodeSigning
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 385B337CFC49620E
- SHA-256: 80AD8D248D6013EFF003366456CDDA6CF85BC4791A678152E178C72B5A7F12CD
- SPKI SHA-256: 59337F6B2AA56FB01737C19D80F2B58B8D04A87196038B9A18F16944A098D7C5
- Validity: 2019-01-16 to 2029-01-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4060896100906263054 (0x385b337cfc49620e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Jan 16 21:10:25 2019 GMT
            Not After : Jan 13 21:10:25 2029 GMT
        Subject: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for CodeSigning
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                50:05:C0:CA:76:69:DC:72:5A:CA:EB:A9:56:78:83:AC:02:CB:6D:89
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 80AD8D248D6013EFF003366456CDDA6CF85BC4791A678152E178C72B5A7F12CD
    SPKI SHA256: 59337F6B2AA56FB01737C19D80F2B58B8D04A87196038B9A18F16944A098D7C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InterCloud Ventures CA for EV SSL RSA

- Subject: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for EV SSL RSA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 28E76FE89B3A3746
- SHA-256: 3964D85BEFA07FE1F1F932C0FEF2367DE58007C1045F964D3D2D0DD92105AA84
- SPKI SHA-256: 5AD75DDF06906F02697A488DAD99B070605CB9441FEEE98AD28EB0D1EFA84960
- Validity: 2019-01-16 to 2029-01-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2947447525964658502 (0x28e76fe89b3a3746)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Jan 16 21:08:00 2019 GMT
            Not After : Jan 13 21:08:00 2029 GMT
        Subject: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for EV SSL RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                C9:82:20:DC:CF:C7:80:34:E9:1E:6C:34:88:0E:3C:72:88:5F:B4:87
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3964D85BEFA07FE1F1F932C0FEF2367DE58007C1045F964D3D2D0DD92105AA84
    SPKI SHA256: 5AD75DDF06906F02697A488DAD99B070605CB9441FEEE98AD28EB0D1EFA84960
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LATSSL EV TLS Issuing RSA CA 1

- Subject: countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL EV TLS Issuing RSA CA 1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Serial: 09ADAC413A8D5590C99EB29523ADA851
- SHA-256: 7F1AD73878E0EA7CFD705675C4DDA688CB25E122F6C8564FDDFC14BDBF041837
- SPKI SHA-256: A9FDFB7A7362D4E710D4B0C80D32C38052023702A1F9F0C40820175352906D85
- Validity: 2023-06-26 to 2033-06-23
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/LATSSL-EVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            09:ad:ac:41:3a:8d:55:90:c9:9e:b2:95:23:ad:a8:51
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Validity
            Not Before: Jun 26 16:45:33 2023 GMT
            Not After : Jun 23 16:45:32 2033 GMT
        Subject: C = MX, O = LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), CN = LATSSL EV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                D7:4D:56:03:3C:A1:C7:A6:90:84:0B:E3:D4:3A:90:91:D8:DC:E9:11
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7F1AD73878E0EA7CFD705675C4DDA688CB25E122F6C8564FDDFC14BDBF041837
    SPKI SHA256: A9FDFB7A7362D4E710D4B0C80D32C38052023702A1F9F0C40820175352906D85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LATSSL EV TLS Issuing RSA CA 2

- Subject: countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL EV TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit RSA CA R2
- Serial: 42957FCBC546194A64C19ECA83194D49
- SHA-256: 595C68403E1C3ED74213B1AD2EB216E3C1CD2E458A9863785030D027552C9F93
- SPKI SHA-256: 0D47241A1CE321E78AACE0667618491BEA2C3C9C3C2016F664320CE24D5FC425
- Validity: 2025-05-07 to 2035-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/LATSSL-EVTLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:95:7f:cb:c5:46:19:4a:64:c1:9e:ca:83:19:4d:49
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit RSA CA R2
        Validity
            Not Before: May  7 18:54:20 2025 GMT
            Not After : May  5 18:54:19 2035 GMT
        Subject: C = MX, O = LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), CN = LATSSL EV TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:0D:2F:A5:FA:75:F5:3A:F1:DF:EE:63:0B:D3:2C:27:CA:03:4F:75
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-EVTLS-T-RSA-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                33:9C:9E:D3:B5:76:FA:57:D9:C4:6B:BF:E6:D5:28:19:B8:85:0B:7B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 595C68403E1C3ED74213B1AD2EB216E3C1CD2E458A9863785030D027552C9F93
    SPKI SHA256: 0D47241A1CE321E78AACE0667618491BEA2C3C9C3C2016F664320CE24D5FC425
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-EVTLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LATSSL TLS Issuing RSA CA 1

- Subject: countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL TLS Issuing RSA CA 1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 50CAC813D98FB6AB5557BFDC3D589500
- SHA-256: 5355C4F8C6CC330B0D813D6194CF206895EE6F3977AC0C99E509260488E6D5C8
- SPKI SHA-256: A6EC0A6855F793DD1670A5914838AEAD64846BD1E0B3C3BEF785847BF81AC176
- Validity: 2023-06-26 to 2033-06-23
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/LATSSL-TLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:ca:c8:13:d9:8f:b6:ab:55:57:bf:dc:3d:58:95:00
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Jun 26 16:43:13 2023 GMT
            Not After : Jun 23 16:43:12 2033 GMT
        Subject: C = MX, O = LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), CN = LATSSL TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                BB:E1:25:C7:9B:85:A4:6D:30:E2:7E:B5:3C:A9:9B:DF:C8:88:8B:B2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5355C4F8C6CC330B0D813D6194CF206895EE6F3977AC0C99E509260488E6D5C8
    SPKI SHA256: A6EC0A6855F793DD1670A5914838AEAD64846BD1E0B3C3BEF785847BF81AC176
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### LATSSL TLS Issuing RSA CA 2

- Subject: countryName=MX, organizationName=LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), commonName=LATSSL TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 5AFBB19216AC7D3F5CFD44C58645D33E
- SHA-256: 2411E6D673FBB7D296655FD97EFC2D54BC5F22B781F73A2338B44A62A148E642
- SPKI SHA-256: 2080E0F9097163A3DFF83E3B6662B659F472A0DC23341127C5C2E3E4AA117703
- Validity: 2025-05-07 to 2035-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/LATSSL-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:fb:b1:92:16:ac:7d:3f:5c:fd:44:c5:86:45:d3:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May  7 18:52:47 2025 GMT
            Not After : May  5 18:52:46 2035 GMT
        Subject: C = MX, O = LATSSL (Intradigital Soluciones Tecnologicas S. de R.L. de C.V), CN = LATSSL TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                45:2E:C1:A9:41:C5:12:35:91:91:07:E0:8C:C4:AC:38:FE:DB:9B:6B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2411E6D673FBB7D296655FD97EFC2D54BC5F22B781F73A2338B44A62A148E642
    SPKI SHA256: 2080E0F9097163A3DFF83E3B6662B659F472A0DC23341127C5C2E3E4AA117703
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Leocert TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=Leocert LLC, commonName=Leocert TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 5B70BABD1ED5E741C0F6C392E05A340D
- SHA-256: 79089DA0678E085080E58D54C462B313EF78416A8724FACE7D1A8937438E00C7
- SPKI SHA-256: 54228C4843E513F5A6D7287571590F4FDA855BDE49EB8E8E33D0DD8A19D312B7
- Validity: 2024-03-21 to 2034-03-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Leocert-TLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:70:ba:bd:1e:d5:e7:41:c0:f6:c3:92:e0:5a:34:0d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: Mar 21 18:00:46 2024 GMT
            Not After : Mar 19 18:00:45 2034 GMT
        Subject: C = US, O = Leocert LLC, CN = Leocert TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                70:6F:AA:ED:30:97:C6:B7:0D:48:60:E2:0B:17:ED:F3:0B:F1:49:0E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 79089DA0678E085080E58D54C462B313EF78416A8724FACE7D1A8937438E00C7
    SPKI SHA256: 54228C4843E513F5A6D7287571590F4FDA855BDE49EB8E8E33D0DD8A19D312B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Leocert TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=Leocert LLC, commonName=Leocert TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 0B455582BC2106252409DD73D4909488
- SHA-256: 1A70FE182751E637C0E5D3D553E75BDBA1D655FFE5411D9B390B73C8378FA72C
- SPKI SHA-256: 4CB1B7935BE2A65C026B814837AEB22875F0530A63BA4FB361A5C7949288D666
- Validity: 2024-03-21 to 2034-03-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Leocert-TLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:45:55:82:bc:21:06:25:24:09:dd:73:d4:90:94:88
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: Mar 21 17:58:35 2024 GMT
            Not After : Mar 19 17:58:34 2034 GMT
        Subject: C = US, O = Leocert LLC, CN = Leocert TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                17:D9:D3:F2:D0:69:E8:1E:37:B7:F9:56:3A:07:E6:29:D3:95:5B:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1A70FE182751E637C0E5D3D553E75BDBA1D655FFE5411D9B390B73C8378FA72C
    SPKI SHA256: 4CB1B7935BE2A65C026B814837AEB22875F0530A63BA4FB361A5C7949288D666
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Lexagle Document Signing Issuing ECC CA 1

- Subject: countryName=SG, organizationName=LEXAGLE PTE. LTD., commonName=Lexagle Document Signing Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit ECC CA R1
- Serial: 4248CA383B5F79ABA56A143CAE500E9F
- SHA-256: B531B45A1A3384D9DA0575AB8A8493DBB621246B804EBFA27541D99DA4483B90
- SPKI SHA-256: 67128016FB1FDBF34789D98F88CC0853BCD535E1450364CE3039F64852883EBD
- Validity: 2023-04-20 to 2033-04-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crls.ssl.com/Lexagle-docSigning-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:48:ca:38:3b:5f:79:ab:a5:6a:14:3c:ae:50:0e:9f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit ECC CA R1
        Validity
            Not Before: Apr 20 16:07:03 2023 GMT
            Not After : Apr 17 16:07:02 2033 GMT
        Subject: C = SG, O = LEXAGLE PTE. LTD., CN = Lexagle Document Signing Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                0B:B1:7B:BF:F3:B8:43:45:DB:10:BE:97:CF:14:43:DE:22:B0:93:F5
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-ECC-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
            X509v3 Subject Key Identifier:
                D5:0E:44:4E:6E:5C:5B:F7:F9:A7:26:5D:F5:9D:C6:6B:AA:8F:64:3D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B531B45A1A3384D9DA0575AB8A8493DBB621246B804EBFA27541D99DA4483B90
    SPKI SHA256: 67128016FB1FDBF34789D98F88CC0853BCD535E1450364CE3039F64852883EBD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-ECC-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Micros CA

- Subject: countryName=US, stateOrProvinceName=Maryland, localityName=Columbia, organizationName=Micros Systems, Inc., commonName=Micros CA
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 2, emailAddress=ca@trustwave.com
- Serial: 6B49D205
- SHA-256: 2EE746858D3FEEA35CFD15AD8D0FA8CE26B7DCE34642ABF2E33FE13E709C1CF5
- SPKI SHA-256: B563AD0E12AA9A1363F53A652B09DA4E05CF679FE60C19F0AEB2717C26542C4B
- Validity: 2010-04-01 to 2020-03-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.35539.3.3.3.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1800000005 (0x6b49d205)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Issuing CA, Level 2", emailAddress = ca@trustwave.com
        Validity
            Not Before: Apr  1 18:23:53 2010 GMT
            Not After : Mar 29 18:23:53 2020 GMT
        Subject: C = US, ST = Maryland, L = Columbia, O = "Micros Systems, Inc.", CN = Micros CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                C6:6B:91:57:43:4E:5B:93:15:CA:C2:14:40:9E:2C:43:7E:EF:18:18
            X509v3 Authority Key Identifier:
                92:08:64:B1:BB:9F:A4:91:5B:5E:AF:53:ED:E2:92:F3:DB:66:AD:31
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.35539.3.3.3.3.3
                  CPS: http://ssl.trustwave.com/CA/micros
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2EE746858D3FEEA35CFD15AD8D0FA8CE26B7DCE34642ABF2E33FE13E709C1CF5
    SPKI SHA256: B563AD0E12AA9A1363F53A652B09DA4E05CF679FE60C19F0AEB2717C26542C4B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.35539.3.3.3.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### Micros Internal CA

- Subject: countryName=US, stateOrProvinceName=Maryland, localityName=Columbia, organizationName=Micros Systems, Inc., commonName=Micros Internal CA
- Issuer: countryName=US, stateOrProvinceName=Maryland, localityName=Columbia, organizationName=Micros Systems, Inc., commonName=Micros CA
- Serial: 4786DDCA
- SHA-256: 358487D0691F70657439C5AF0EA1B44C036D727A3E55BA7D919D611DAB73C353
- SPKI SHA-256: C38A89D64DD2B3482916F54160F0E9B37891ADDB4589B1EBA145407E240E0A26
- Validity: 2010-04-01 to 2020-03-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.35539.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1200020938 (0x4786ddca)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = Maryland, L = Columbia, O = "Micros Systems, Inc.", CN = Micros CA
        Validity
            Not Before: Apr  1 18:31:30 2010 GMT
            Not After : Mar 29 18:31:30 2020 GMT
        Subject: C = US, ST = Maryland, L = Columbia, O = "Micros Systems, Inc.", CN = Micros Internal CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4E:20:84:A2:D5:A4:81:A5:48:4E:2F:96:DB:21:3D:C0:B6:8D:DB:EF
            X509v3 Authority Key Identifier:
                C6:6B:91:57:43:4E:5B:93:15:CA:C2:14:40:9E:2C:43:7E:EF:18:18
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.35539.3.3.4.3.3
                  CPS: http://ssl.trustwave.com/CA/micros
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 358487D0691F70657439C5AF0EA1B44C036D727A3E55BA7D919D611DAB73C353
    SPKI SHA256: C38A89D64DD2B3482916F54160F0E9B37891ADDB4589B1EBA145407E240E0A26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.35539.3.3.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- is_expired

### MilleniumSign Client Certificate CA ECC R3

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Client Certificate CA ECC R3
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA ECC R3
- Serial: 1449E37AD9B9AC8DBF9187B1470DDECD
- SHA-256: 301119BCEB7A72E7E27B8AD8795FC9B2EAEC65757F6FFF4F5ABA161A1A268E8A
- SPKI SHA-256: F37775215AF6C53BC7FCF68D91B9D32F891C8BA9A251A16D77B40B23EC3E035C
- Validity: 2019-04-01 to 2024-03-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-clientCert-ECC-384-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-ECC-384-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:49:e3:7a:d9:b9:ac:8d:bf:91:87:b1:47:0d:de:cd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA ECC R3
        Validity
            Not Before: Apr  1 17:19:56 2019 GMT
            Not After : Mar 30 17:19:56 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign Client Certificate CA ECC R3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:6D:0C:3D:41:3D:D0:51:94:8F:53:E3:80:2F:58:7B:8C:84:96:47
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-clientCert-ECC-384-R3.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-ECC-384-R3.crl
            X509v3 Subject Key Identifier:
                35:E9:38:72:F1:28:42:3B:B4:7C:04:8B:81:DF:15:B4:A6:93:2C:27
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 301119BCEB7A72E7E27B8AD8795FC9B2EAEC65757F6FFF4F5ABA161A1A268E8A
    SPKI SHA256: F37775215AF6C53BC7FCF68D91B9D32F891C8BA9A251A16D77B40B23EC3E035C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-clientCert-ECC-384-R3.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-ECC-384-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign Client Certificate CA RSA

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Client Certificate CA RSA
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA RSA
- Serial: 4295168CAEB46A3B
- SHA-256: C30825CC484D8A040E53CF149B1AC97DDDB7531BAAB9A02949955DD193A9234D
- SPKI SHA-256: 84E16318063BD592EEF0F3EDEDAD9B102C29E5E43AE0C561998F9832E468CFD8
- Validity: 2019-02-25 to 2024-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-clientCert-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4797765771515423291 (0x4295168caeb46a3b)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA RSA
        Validity
            Not Before: Feb 25 19:20:54 2019 GMT
            Not After : Feb 24 19:20:54 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign Client Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:2E:64:F2:47:D3:D7:AB:D2:CA:45:7B:08:66:8C:FA:0B:C7:E9:42
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-clientCert-RSA-4096-R2.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                68:79:40:1B:9A:9C:B1:16:C6:3B:6D:18:24:FB:49:CB:EC:DD:13:80
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C30825CC484D8A040E53CF149B1AC97DDDB7531BAAB9A02949955DD193A9234D
    SPKI SHA256: 84E16318063BD592EEF0F3EDEDAD9B102C29E5E43AE0C561998F9832E468CFD8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-clientCert-RSA-4096-R2.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign Client Certificate CA RSA R3

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Client Certificate CA RSA R3
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Client Certificate CA RSA R3
- Serial: 5675C4BAB2C864643A16202CBF976CA5
- SHA-256: CF1096BB9323D972DC324B67371DC04FF9D818F8325F9B1424FAFFC4861617DE
- SPKI SHA-256: AF18D5638CDC4D82AD20E35293B9FA2FB32B2587BF343D8DC1A5ED35050FE533
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-clientCert-RSA-4096-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:75:c4:ba:b2:c8:64:64:3a:16:20:2c:bf:97:6c:a5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Client Certificate CA RSA R3
        Validity
            Not Before: Apr  1 17:23:05 2019 GMT
            Not After : Mar 30 17:23:05 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign Client Certificate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:CD:CE:76:B8:65:7E:58:D1:46:63:AC:A4:BF:96:4D:BC:B8:C4:49
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-clientCert-RSA-4096-R3.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R3.crl
            X509v3 Subject Key Identifier:
                79:83:EC:0F:31:2D:77:5E:40:F5:A5:B6:7A:A1:C7:68:0C:2E:72:A1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF1096BB9323D972DC324B67371DC04FF9D818F8325F9B1424FAFFC4861617DE
    SPKI SHA256: AF18D5638CDC4D82AD20E35293B9FA2FB32B2587BF343D8DC1A5ED35050FE533
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-clientCert-RSA-4096-R3.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-clientCert-RSA-4096-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign Code Signing Certificate CA RSA

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Code Signing Certificate CA RSA
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Code Signing Certificate CA RSA
- Serial: 2D01D4D125B89F04
- SHA-256: A5C7151DAAC0C328A69DC64D677BD667033710867FD3E219E47E2A49E0BB42BF
- SPKI SHA-256: 59D48B3A8A15E5343C7264B6A1720ADD0098D0B229E64BA97596DB528E69B185
- Validity: 2019-02-25 to 2024-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-codeSigning-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3243107201429577476 (0x2d01d4d125b89f04)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Code Signing Certificate CA RSA
        Validity
            Not Before: Feb 25 19:24:33 2019 GMT
            Not After : Feb 24 19:24:33 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign Code Signing Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                71:AD:33:77:B2:F2:52:DA:F1:00:9E:32:21:2E:77:A2:F2:20:99:6E
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R2.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                0C:D7:AD:D6:B7:D7:2E:C3:67:CB:D7:8D:AC:B9:B1:7A:13:31:7F:EB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A5C7151DAAC0C328A69DC64D677BD667033710867FD3E219E47E2A49E0BB42BF
    SPKI SHA256: 59D48B3A8A15E5343C7264B6A1720ADD0098D0B229E64BA97596DB528E69B185
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R2.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign Code Signing Certificate CA RSA R3

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign Code Signing Certificate CA RSA R3
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud Code Signing Certificate CA RSA R3
- Serial: 12E3C6B9E1948F733E69148EB288505E
- SHA-256: 95BE6D3C2E2A3A27695F3B313B6EAF0CBA13ED5450D2041D47DCD57AEF7C7BEB
- SPKI SHA-256: 97FD0D1FF8A448BAD308A32FBF3E9D90DCDFC7E04F93DC0EDAB00CD5F1C71291
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-codeSigning-RSA-4096-R3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:e3:c6:b9:e1:94:8f:73:3e:69:14:8e:b2:88:50:5e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud Code Signing Certificate CA RSA R3
        Validity
            Not Before: Apr  1 17:26:48 2019 GMT
            Not After : Mar 30 17:26:48 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign Code Signing Certificate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                BE:9B:FB:7D:4D:24:C9:3E:F0:39:B4:BE:0F:36:74:27:85:DE:B9:9D
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R3.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R3.crl
            X509v3 Subject Key Identifier:
                C7:F7:EF:13:F5:6F:4D:66:78:F0:1E:DC:4F:B3:BF:73:43:11:46:0D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 95BE6D3C2E2A3A27695F3B313B6EAF0CBA13ED5450D2041D47DCD57AEF7C7BEB
    SPKI SHA256: 97FD0D1FF8A448BAD308A32FBF3E9D90DCDFC7E04F93DC0EDAB00CD5F1C71291
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R3.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign EV SSL Certificate CA RSA

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign EV SSL Certificate CA RSA
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud EV SSL Certificate CA RSA
- Serial: 30CCE71C88D96294
- SHA-256: F704F424718A53C34DC0B81BD3CAD89CC2CD6B62F5E17F9FED7FEC8DAEE39857
- SPKI SHA-256: 13E5D55BE7CB9A7AA65A11C2B478E72B94894F4502D8E0D10247A2C90745D1AB
- Validity: 2019-02-25 to 2024-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-EV-SSL-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3516439518810563220 (0x30cce71c88d96294)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud EV SSL Certificate CA RSA
        Validity
            Not Before: Feb 25 19:13:56 2019 GMT
            Not After : Feb 24 19:13:56 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign EV SSL Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                34:A9:FA:20:3D:DE:3D:97:F7:C7:06:1F:47:A9:2F:31:58:16:4C:CC
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R2.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                78:40:0C:7B:8E:A9:2A:C2:6D:59:46:19:5E:C7:7E:54:66:15:B4:3A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F704F424718A53C34DC0B81BD3CAD89CC2CD6B62F5E17F9FED7FEC8DAEE39857
    SPKI SHA256: 13E5D55BE7CB9A7AA65A11C2B478E72B94894F4502D8E0D10247A2C90745D1AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R2.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign EV SSL Certificate CA RSA R3

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign EV SSL Certificate CA RSA R3
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud EV SSL Certificate CA RSA R3
- Serial: 624FCA201CBF6B0B1948E18C08A9F100
- SHA-256: 9BA665B86E2721F51EF0650B728568A93C0D69B56D8D38E630530E745D663B4F
- SPKI SHA-256: 15DF52822CC2401B357CF7F3E58D99F81CA14D8B072BAC93D316F3AAB4A272C5
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:4f:ca:20:1c:bf:6b:0b:19:48:e1:8c:08:a9:f1:00
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud EV SSL Certificate CA RSA R3
        Validity
            Not Before: Apr  1 17:29:59 2019 GMT
            Not After : Mar 30 17:29:59 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign EV SSL Certificate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                7D:80:B4:AC:03:D5:0D:0E:42:5B:B8:63:39:6E:17:F2:0F:76:8D:25
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R3.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R3.crl
            X509v3 Subject Key Identifier:
                5C:C1:C3:97:2F:EB:DF:D9:08:59:99:3D:55:10:2F:DC:EC:FC:30:21
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9BA665B86E2721F51EF0650B728568A93C0D69B56D8D38E630530E745D663B4F
    SPKI SHA256: 15DF52822CC2401B357CF7F3E58D99F81CA14D8B072BAC93D316F3AAB4A272C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R3.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign for ClientCert RSA

- Subject: countryName=MU, organizationName=MilleniumSign Limited, commonName=MilleniumSign for ClientCert RSA
- Issuer: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for ClientCert RSA
- Serial: 49BC54B9B732A826
- SHA-256: 482F6936162DAC4EF7746E61CF81F3573C308A9F0CE6B41AB6E2E3F89B79F5BA
- SPKI SHA-256: ED147E9B10AABB4CD700AD823CFE7B7BCAB4A44F000B3EC77EBED50803EE333B
- Validity: 2019-01-18 to 2024-01-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-clientCert-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/IntercloudVentures-Intermediate-clientCert-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5313214817009575974 (0x49bc54b9b732a826)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for ClientCert RSA
        Validity
            Not Before: Jan 18 19:19:48 2019 GMT
            Not After : Jan 17 19:19:48 2024 GMT
        Subject: C = MU, O = MilleniumSign Limited, CN = MilleniumSign for ClientCert RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                78:A1:D7:59:38:A9:48:6C:8A:E1:54:6C:97:80:0D:98:62:A8:A0:76
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/IntercloudVentures-Intermediate-clientCert-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/IntercloudVentures-Intermediate-clientCert-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                32:2C:4D:24:40:64:1E:10:11:DA:9B:78:96:28:D8:4F:64:95:46:B7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 482F6936162DAC4EF7746E61CF81F3573C308A9F0CE6B41AB6E2E3F89B79F5BA
    SPKI SHA256: ED147E9B10AABB4CD700AD823CFE7B7BCAB4A44F000B3EC77EBED50803EE333B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/IntercloudVentures-Intermediate-clientCert-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/IntercloudVentures-Intermediate-clientCert-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign for Code Signing

- Subject: countryName=MU, organizationName=MilleniumSign Limited, commonName=MilleniumSign for Code Signing
- Issuer: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for CodeSigning
- Serial: 23E0565EBCDA2849
- SHA-256: 822E3D8CE96462B4D19CB6AAC2FCD6D01BC802F927A98801BEE41A6006ABDB08
- SPKI SHA-256: AA55E6B6B22EA95F6F9CDB0949C8BA33FB0985994C1973E71C960710DD384D39
- Validity: 2019-01-21 to 2024-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-codeSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2585161151005993033 (0x23e0565ebcda2849)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for CodeSigning
        Validity
            Not Before: Jan 21 20:13:52 2019 GMT
            Not After : Jan 20 20:13:52 2024 GMT
        Subject: C = MU, O = MilleniumSign Limited, CN = MilleniumSign for Code Signing
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                50:05:C0:CA:76:69:DC:72:5A:CA:EB:A9:56:78:83:AC:02:CB:6D:89
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                63:81:99:6F:9C:02:23:D1:81:B3:DE:E6:EF:96:E4:18:55:8C:16:2D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 822E3D8CE96462B4D19CB6AAC2FCD6D01BC802F927A98801BEE41A6006ABDB08
    SPKI SHA256: AA55E6B6B22EA95F6F9CDB0949C8BA33FB0985994C1973E71C960710DD384D39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/IntercloudVentures-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign for EV SSL

- Subject: countryName=MU, organizationName=MilleniumSign Limited, commonName=MilleniumSign for EV SSL
- Issuer: countryName=SC, organizationName=InterCloud Ventures Inc, commonName=InterCloud Ventures CA for EV SSL RSA
- Serial: 55F682A2D378385A
- SHA-256: 88C18EC484289787A07A9B7022D57E4B334F792F64314A44ECDD1AEAB1448406
- SPKI SHA-256: 6ED53FB64A98893899E61CBD4BF328095C69238B87842FA4399434B929B6B167
- Validity: 2019-01-21 to 2024-01-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6194281973338880090 (0x55f682a2d378385a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, O = InterCloud Ventures Inc, CN = InterCloud Ventures CA for EV SSL RSA
        Validity
            Not Before: Jan 21 20:10:35 2019 GMT
            Not After : Jan 20 20:10:35 2024 GMT
        Subject: C = MU, O = MilleniumSign Limited, CN = MilleniumSign for EV SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C9:82:20:DC:CF:C7:80:34:E9:1E:6C:34:88:0E:3C:72:88:5F:B4:87
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                E8:EA:DF:29:AE:EA:8A:CA:D6:3E:B7:79:0E:19:D5:2E:E8:08:A7:3F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 88C18EC484289787A07A9B7022D57E4B334F792F64314A44ECDD1AEAB1448406
    SPKI SHA256: 6ED53FB64A98893899E61CBD4BF328095C69238B87842FA4399434B929B6B167
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/IntercloudVentures-Intermediate-EV-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign SSL Certificate CA ECC R2

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign SSL Certificate CA ECC R2
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA ECC R2
- Serial: 38544673624EB187CCB836362D64A83B
- SHA-256: 2C490F53013601163C7E9BA74870181989DA4700BDBCAE99AD2164E94285FB41
- SPKI SHA-256: AD91F1EA85AC438337DA97092AC926FBECAB1E2D739C286288D9FE1F2C7587C3
- Validity: 2019-04-01 to 2024-03-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-ECC-384-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:54:46:73:62:4e:b1:87:cc:b8:36:36:2d:64:a8:3b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA ECC R2
        Validity
            Not Before: Apr  1 17:32:50 2019 GMT
            Not After : Mar 30 17:32:50 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign SSL Certificate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                61:3F:BA:0D:39:EF:4B:82:A3:92:43:C3:C4:21:64:9A:FE:FE:0F:BD
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-SSL-ECC-384-R2.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-ECC-384-R2.crl
            X509v3 Subject Key Identifier:
                27:6F:3B:3F:2D:1B:F8:BA:74:51:94:41:29:01:34:92:D3:14:28:1C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2C490F53013601163C7E9BA74870181989DA4700BDBCAE99AD2164E94285FB41
    SPKI SHA256: AD91F1EA85AC438337DA97092AC926FBECAB1E2D739C286288D9FE1F2C7587C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-SSL-ECC-384-R2.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-ECC-384-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign SSL Certificate CA RSA

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign SSL Certificate CA RSA
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA RSA
- Serial: 713C71899E0B08E4
- SHA-256: 478FAFF5912D05AEBEDC9AEF8C2521A212688000525771E33DAB82B47533F712
- SPKI SHA-256: 10E52C6B65E5855E9C49B2ABA89FD7303ED50133EB4E639B1DC46A199D11A415
- Validity: 2019-02-25 to 2024-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.africa/MilleniumSign-Intermediate-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8159521460764477668 (0x713c71899e0b08e4)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA RSA
        Validity
            Not Before: Feb 25 19:17:35 2019 GMT
            Not After : Feb 24 19:17:35 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign SSL Certificate CA RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                34:A0:65:F7:B0:BF:36:03:16:B9:87:5E:14:4D:89:7B:80:22:3A:8F
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                46:57:8C:10:0C:95:50:C9:F4:A6:F4:D5:88:4B:4E:28:52:59:6A:36
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 478FAFF5912D05AEBEDC9AEF8C2521A212688000525771E33DAB82B47533F712
    SPKI SHA256: 10E52C6B65E5855E9C49B2ABA89FD7303ED50133EB4E639B1DC46A199D11A415
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MilleniumSign SSL Certificate CA RSA R2

- Subject: countryName=MU, stateOrProvinceName=Plaines Wilhems, localityName=Ebene, organizationName=MilleniumSign Limited, commonName=MilleniumSign SSL Certificate CA RSA R2
- Issuer: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=InterCloud Ventures Inc, commonName=InterCloud SSL Certificate CA RSA R2
- Serial: 656BE86339CDB125D1AE237E92C4E9AD
- SHA-256: 36C7E329750A403DB0BAF069C9A9F33963E5C98A66A8AB57016DB6F88CC5614D
- SPKI SHA-256: D63341CAEF4DE6D73990BD087D65B8F80214427A7A96354B07744E5FE700E9BE
- Validity: 2019-04-01 to 2024-03-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.ca.pki.africa
- CRL DP: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:6b:e8:63:39:cd:b1:25:d1:ae:23:7e:92:c4:e9:ad
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = SC, ST = Mah\C3\A9, L = Victoria, O = InterCloud Ventures Inc, CN = InterCloud SSL Certificate CA RSA R2
        Validity
            Not Before: Apr  1 17:35:44 2019 GMT
            Not After : Mar 30 17:35:44 2024 GMT
        Subject: C = MU, ST = Plaines Wilhems, L = Ebene, O = MilleniumSign Limited, CN = MilleniumSign SSL Certificate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                06:2F:A6:50:14:B4:9A:11:E7:74:75:8A:84:EF:CD:81:43:13:8E:1E
            Authority Information Access:
                CA Issuers - URI:http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-SSL-RSA-4096-R2.crt
                OCSP - URI:http://ocsp.ca.pki.africa
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                89:24:8A:84:19:DC:FA:F1:E1:5F:92:0A:48:86:3B:F3:08:79:D5:50
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 36C7E329750A403DB0BAF069C9A9F33963E5C98A66A8AB57016DB6F88CC5614D
    SPKI SHA256: D63341CAEF4DE6D73990BD087D65B8F80214427A7A96354B07744E5FE700E9BE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.ca.pki.africa
- AIA CA Issuers: http://repo.ca.pki.africa/repository/IntercloudVentures-Intermediate-SSL-RSA-4096-R2.crt
- CRL Distribution Points: http://crl.ca.pki.africa/IntercloudVentures-Intermediate-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### MTA-New York City Transit CA

- Subject: countryName=US, stateOrProvinceName=New York, localityName=New York, organizationName=MTA-NYCT, commonName=MTA-New York City Transit CA
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 2, emailAddress=ca@trustwave.com
- Serial: 6B49D207
- SHA-256: FA3C30D73B879171FF94706225161040D1B2A15B6DD84F210B054EF49C2A0BC3
- SPKI SHA-256: F065C80D7576D2FCD7EBEE78ECA962D78D32AA68D0CB58DB999BA5604110F1D4
- Validity: 2012-02-02 to 2022-01-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.38578.3.3.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.trustwave.com/ORGCA_L2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1800000007 (0x6b49d207)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Issuing CA, Level 2", emailAddress = ca@trustwave.com
        Validity
            Not Before: Feb  2 16:50:36 2012 GMT
            Not After : Jan 30 16:50:36 2022 GMT
        Subject: C = US, ST = New York, L = New York, O = MTA-NYCT, CN = MTA-New York City Transit CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 36779 (0x8fab)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2B:5C:E9:23:AA:79:73:21:F7:A5:12:AF:E4:27:46:D8:1A:6F:04:99
            X509v3 Authority Key Identifier:
                92:08:64:B1:BB:9F:A4:91:5B:5E:AF:53:ED:E2:92:F3:DB:66:AD:31
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/ORGCA_L2.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.38578.3.3.3.3.4.3.3
                  CPS: http://ssl.trustwave.com/CA/nyct
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FA3C30D73B879171FF94706225161040D1B2A15B6DD84F210B054EF49C2A0BC3
    SPKI SHA256: F065C80D7576D2FCD7EBEE78ECA962D78D32AA68D0CB58DB999BA5604110F1D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.38578.3.3.3.3.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/ORGCA_L2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### MuaSSL.com EV TLS Issuing ECC CA 2

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit ECC CA R2
- Serial: 3AEF1F240E640F00C7AEB00420288ACD
- SHA-256: 6ED37A6CDAEDFF67B5224C27A120FECBFB98DA00FB95515491A9CA1962C651C0
- SPKI SHA-256: CCA117AF5C1847CA34C9E05B2E73334A939D5987B6049F3157FF3B9681B19710
- Validity: 2025-05-07 to 2035-05-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-EVTLS-I-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:ef:1f:24:0e:64:0f:00:c7:ae:b0:04:20:28:8a:cd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit ECC CA R2
        Validity
            Not Before: May  7 18:59:59 2025 GMT
            Not After : May  5 18:59:58 2035 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com EV TLS Issuing ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                37:30:1E:64:2D:19:68:F3:FD:6E:B1:72:0D:EF:6C:FB:0A:40:4C:90
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-EVTLS-T-ECC-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                87:2A:C3:61:36:87:C7:94:0C:41:47:FE:70:73:0A:60:7E:33:C8:D5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6ED37A6CDAEDFF67B5224C27A120FECBFB98DA00FB95515491A9CA1962C651C0
    SPKI SHA256: CCA117AF5C1847CA34C9E05B2E73334A939D5987B6049F3157FF3B9681B19710
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-EVTLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### MuaSSL.com EV TLS Issuing ECC CA R1

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Serial: 32EFB8E04919BFE16E556D2D76367E31
- SHA-256: 785FD32364C457E2AEB4353AA95808F371AA8906E11C40E13C338A6B3EE73BE1
- SPKI SHA-256: 2ACCA6448D858A1A19E5CE66D34D1B933A58AA4F4E7D728C04FCFB584A1DA848
- Validity: 2021-11-16 to 2031-11-14
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-EVTLS-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:ef:b8:e0:49:19:bf:e1:6e:55:6d:2d:76:36:7e:31
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Validity
            Not Before: Nov 16 19:15:13 2021 GMT
            Not After : Nov 14 19:15:12 2031 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com EV TLS Issuing ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                DB:D2:C6:52:83:15:2F:7E:6A:66:A5:A2:C8:82:D7:A9:FD:C2:E3:2B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 785FD32364C457E2AEB4353AA95808F371AA8906E11C40E13C338A6B3EE73BE1
    SPKI SHA256: 2ACCA6448D858A1A19E5CE66D34D1B933A58AA4F4E7D728C04FCFB584A1DA848
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### MuaSSL.com EV TLS Issuing RSA CA 2

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit RSA CA R2
- Serial: 2DE6417AA879CF1E467E2573048DE983
- SHA-256: 6837A498BB69DEC749FFF4FD1F5FFDC5665A7C1A326FC6D7A057866BA00AAFD2
- SPKI SHA-256: D0F85E419C96C0E5481B601A233DA7F276FC0BB3CFC4C83C5140D457FA2785BF
- Validity: 2025-05-07 to 2035-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-EVTLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:e6:41:7a:a8:79:cf:1e:46:7e:25:73:04:8d:e9:83
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit RSA CA R2
        Validity
            Not Before: May  7 19:01:22 2025 GMT
            Not After : May  5 19:01:21 2035 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com EV TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:0D:2F:A5:FA:75:F5:3A:F1:DF:EE:63:0B:D3:2C:27:CA:03:4F:75
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-EVTLS-T-RSA-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                EC:B4:F4:61:C6:56:E8:A8:0E:27:AD:9F:4A:09:EB:08:FE:9E:EE:EF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6837A498BB69DEC749FFF4FD1F5FFDC5665A7C1A326FC6D7A057866BA00AAFD2
    SPKI SHA256: D0F85E419C96C0E5481B601A233DA7F276FC0BB3CFC4C83C5140D457FA2785BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-EVTLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### MuaSSL.com EV TLS Issuing RSA CA R1

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com EV TLS Issuing RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Serial: 1DDE2C57C2F0C41D99E4919765C71C3B
- SHA-256: 38F58CAF650CCD4F6027D1C922682891A165FEF491FC1D333FE8A9C851586D48
- SPKI SHA-256: D7701B4C03E04A8E1911797FD5DE77B4185D93FD4E669E36A19F14A3C7FED20B
- Validity: 2021-11-16 to 2031-11-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-EVTLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:de:2c:57:c2:f0:c4:1d:99:e4:91:97:65:c7:1c:3b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Validity
            Not Before: Nov 16 19:20:38 2021 GMT
            Not After : Nov 14 19:20:37 2031 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com EV TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                35:0E:E5:5E:F7:9E:5E:88:47:5B:CB:0F:ED:E1:B6:2E:7E:A6:D3:29
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 38F58CAF650CCD4F6027D1C922682891A165FEF491FC1D333FE8A9C851586D48
    SPKI SHA256: D7701B4C03E04A8E1911797FD5DE77B4185D93FD4E669E36A19F14A3C7FED20B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### MuaSSL.com TLS Issuing ECC CA 2

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 3F63E519CF64E5305C244AAE281AD3C6
- SHA-256: 5F8EB0F8A666953A11AC0B537E70C7BDF20EC739FCD3ABC49051B825A1FD1673
- SPKI SHA-256: 5DA2EB43DD083DCC03A06CD5C484DBA0D0B2B71695690D6375422AF39DF7A924
- Validity: 2025-05-07 to 2035-05-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-TLS-I-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:63:e5:19:cf:64:e5:30:5c:24:4a:ae:28:1a:d3:c6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: May  7 19:03:07 2025 GMT
            Not After : May  5 19:03:06 2035 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com TLS Issuing ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                EA:B1:49:7B:15:39:2A:A9:22:40:1F:96:58:4D:9F:12:87:1A:D8:26
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5F8EB0F8A666953A11AC0B537E70C7BDF20EC739FCD3ABC49051B825A1FD1673
    SPKI SHA256: 5DA2EB43DD083DCC03A06CD5C484DBA0D0B2B71695690D6375422AF39DF7A924
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### MuaSSL.com TLS Issuing ECC CA R1

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 458E97B262F401209016B62684D2014E
- SHA-256: 623ABEC6F85A7028ACA10F5BDC5D81B56B6314DF28743FFCC84ECA32F35AE846
- SPKI SHA-256: 69669D0A9EE431C7DFB9C75CB60376B91ECE0599BE5C9234F6D38BC632DB86FF
- Validity: 2021-11-16 to 2031-11-14
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-TLS-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:8e:97:b2:62:f4:01:20:90:16:b6:26:84:d2:01:4e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Nov 16 19:25:16 2021 GMT
            Not After : Nov 14 19:25:15 2031 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com TLS Issuing ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                58:0D:D3:9C:1E:C0:F9:87:1D:84:05:02:13:55:AC:7C:F3:D8:8B:EA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 623ABEC6F85A7028ACA10F5BDC5D81B56B6314DF28743FFCC84ECA32F35AE846
    SPKI SHA256: 69669D0A9EE431C7DFB9C75CB60376B91ECE0599BE5C9234F6D38BC632DB86FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### MuaSSL.com TLS Issuing RSA CA 2

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 27879B28022895A5DCCE4C4AEC7F2F74
- SHA-256: 00878FD47459C4ADB75AF53FB2C25929776B33469E2EC967DF500CB879624BA8
- SPKI SHA-256: 64626A9685CC8C7DFFB46DF77D4E6FFFAE521A7A9EBCE74971BAAD1976B1856C
- Validity: 2025-05-07 to 2035-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:87:9b:28:02:28:95:a5:dc:ce:4c:4a:ec:7f:2f:74
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May  7 19:04:34 2025 GMT
            Not After : May  5 19:04:33 2035 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                14:70:B6:71:A9:7F:30:13:B5:13:DD:85:40:7E:8B:AE:5D:BB:3E:09
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 00878FD47459C4ADB75AF53FB2C25929776B33469E2EC967DF500CB879624BA8
    SPKI SHA256: 64626A9685CC8C7DFFB46DF77D4E6FFFAE521A7A9EBCE74971BAAD1976B1856C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### MuaSSL.com TLS Issuing RSA CA R1

- Subject: countryName=VN, organizationName=Hao Quang Viet Software Company Limited, commonName=MuaSSL.com TLS Issuing RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 31EE6F1DBF75C3A600563BE0467A203A
- SHA-256: 52999873A3D12A4571DB9A160576A9D951AD4E4A7DA31C5C10613805E9224325
- SPKI SHA-256: EBAE70FCD66C3CEED3117C064919C7CF96C6437B5E0E894AAD306B5E18DC1DCC
- Validity: 2021-11-16 to 2031-11-14
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/MuaSSL-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:ee:6f:1d:bf:75:c3:a6:00:56:3b:e0:46:7a:20:3a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Nov 16 19:30:05 2021 GMT
            Not After : Nov 14 19:30:04 2031 GMT
        Subject: C = VN, O = Hao Quang Viet Software Company Limited, CN = MuaSSL.com TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                49:DB:FE:10:01:3B:F3:F0:26:E5:4F:08:66:AB:09:AE:96:73:2E:34
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 52999873A3D12A4571DB9A160576A9D951AD4E4A7DA31C5C10613805E9224325
    SPKI SHA256: EBAE70FCD66C3CEED3117C064919C7CF96C6437B5E0E894AAD306B5E18DC1DCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Namirial S.p.A EV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Namirial S.p.A EV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 13BF67413D27357BEDAF815EFD304B31
- SHA-256: AB3B58A111BD5975DC763DE55323E9D82B7F4EB2FB39436D9A1670FDFB3305E4
- SPKI SHA-256: CE8C41FA0B6DBC95E1003C49B1CFC351FC93B4F0C327F2FBD386F3F343F7A814
- Validity: 2024-09-26 to 2027-09-26
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Namirial-EVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:bf:67:41:3d:27:35:7b:ed:af:81:5e:fd:30:4b:31
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Sep 26 16:33:08 2024 GMT
            Not After : Sep 26 16:33:07 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Namirial S.p.A EV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                80:DE:05:B2:6A:39:8A:6D:E1:48:A8:AF:6C:E7:3C:86:E7:D6:D6:F5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AB3B58A111BD5975DC763DE55323E9D82B7F4EB2FB39436D9A1670FDFB3305E4
    SPKI SHA256: CE8C41FA0B6DBC95E1003C49B1CFC351FC93B4F0C327F2FBD386F3F343F7A814
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Namirial S.p.A OV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Namirial S.p.A OV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 3A7F1DEEF3665F1BD2264E43CD7A75CB
- SHA-256: 2893A1D054C8C47F79808742E2FD7853874FE5E65712B737BC5B2FC9D17C8EA7
- SPKI SHA-256: B995BA6E57E5DC2CE5529B7B1C12F61DD53B1D8D75EA37CA8A58BBB0CF069144
- Validity: 2024-09-26 to 2027-09-26
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Namirial-OVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:7f:1d:ee:f3:66:5f:1b:d2:26:4e:43:cd:7a:75:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Sep 26 16:32:43 2024 GMT
            Not After : Sep 26 16:32:42 2027 GMT
        Subject: C = US, O = SSL Corporation, CN = Namirial S.p.A OV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                69:1E:5D:8B:AB:AB:29:97:10:7D:74:54:EB:C9:3A:8C:A6:10:9C:53
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2893A1D054C8C47F79808742E2FD7853874FE5E65712B737BC5B2FC9D17C8EA7
    SPKI SHA256: B995BA6E57E5DC2CE5529B7B1C12F61DD53B1D8D75EA37CA8A58BBB0CF069144
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### OCLC TLS Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=OCLC TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 4FC31F72C9383F0BCE2C097B57941206
- SHA-256: D83C4A67007CEB2C7D0DC29F148A0B992A4185C6364AC869995EEC10E6F73E1B
- SPKI SHA-256: E0174E407F1811B4390BE83E8C2F14374657EF9B5EBA058860ED7292047FD5AC
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/OCLC-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:c3:1f:72:c9:38:3f:0b:ce:2c:09:7b:57:94:12:06
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 13:00:50 2026 GMT
            Not After : May 19 13:00:49 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = OCLC TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                31:30:17:7B:AE:51:4A:AE:0B:3F:FE:68:2E:F0:6D:77:CC:82:EB:DA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D83C4A67007CEB2C7D0DC29F148A0B992A4185C6364AC869995EEC10E6F73E1B
    SPKI SHA256: E0174E407F1811B4390BE83E8C2F14374657EF9B5EBA058860ED7292047FD5AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### OCLC TLS Issuing RSA SubCA R1

- Subject: countryName=US, organizationName=OCLC, Inc., commonName=OCLC TLS Issuing RSA SubCA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 5F5B37D3E961025A95807C994573ADB5
- SHA-256: E7527E30D473AEC3B162AFDC47095449D2DD5494CE862E2FE4F436C081262F64
- SPKI SHA-256: B532DC525C41EC76D7AA595C7264E167F5BFD755015C6EB81559A0E8364F7719
- Validity: 2022-09-22 to 2032-09-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/OCLC-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:5b:37:d3:e9:61:02:5a:95:80:7c:99:45:73:ad:b5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Sep 22 17:48:39 2022 GMT
            Not After : Sep 19 17:48:38 2032 GMT
        Subject: C = US, O = "OCLC, Inc.", CN = OCLC TLS Issuing RSA SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                20:98:FB:A1:F9:F3:06:85:F2:97:36:22:B4:80:F6:F5:A8:56:8A:30
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E7527E30D473AEC3B162AFDC47095449D2DD5494CE862E2FE4F436C081262F64
    SPKI SHA256: B532DC525C41EC76D7AA595C7264E167F5BFD755015C6EB81559A0E8364F7719
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### PKIChain TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corp, commonName=PKIChain TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 4C2ED4F12161CF04F0404D391084172D
- SHA-256: 424E23B5A8B95E9C528A68E865127A1D7169E577BF08C76539908525F13629BD
- SPKI SHA-256: 4082C9EFF8703186E9083DE48970B7B0059B09EAD00AAC7A4421FDB489BA0289
- Validity: 2026-07-09 to 2036-07-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/PKIChain-TLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:2e:d4:f1:21:61:cf:04:f0:40:4d:39:10:84:17:2d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: Jul  9 16:37:16 2026 GMT
            Not After : Jul  6 16:37:15 2036 GMT
        Subject: C = US, O = SSL Corp, CN = PKIChain TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                C6:C7:DC:B8:01:2A:78:9D:8C:20:4B:05:2A:DA:3E:C4:3A:DC:04:52
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 424E23B5A8B95E9C528A68E865127A1D7169E577BF08C76539908525F13629BD
    SPKI SHA256: 4082C9EFF8703186E9083DE48970B7B0059B09EAD00AAC7A4421FDB489BA0289
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- not_available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Proof.com Document Signing ECC CA 1

- Subject: countryName=US, organizationName=Proof.com, commonName=Proof.com Document Signing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit ECC CA R1
- Serial: 214FA7037F79D2D0543B16A2F8E5D156
- SHA-256: AE24CFD8DB9252D2F143CBDA6CC8EF423BED8B7C8123867DF1F8FD126DF1B69D
- SPKI SHA-256: 6EAFE7079A2FE9845C93FF564DD9256395FBED328D23A5ACCDFCE96DB7ACE46B
- Validity: 2023-09-01 to 2031-08-30
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crls.ssl.com/Proof.com-docSigning-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:4f:a7:03:7f:79:d2:d0:54:3b:16:a2:f8:e5:d1:56
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit ECC CA R1
        Validity
            Not Before: Sep  1 10:39:50 2023 GMT
            Not After : Aug 30 10:39:49 2031 GMT
        Subject: C = US, O = Proof.com, CN = Proof.com Document Signing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                0B:B1:7B:BF:F3:B8:43:45:DB:10:BE:97:CF:14:43:DE:22:B0:93:F5
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-ECC-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
            X509v3 Subject Key Identifier:
                6E:4D:FE:13:1F:00:5E:93:56:8F:C2:12:4F:68:25:98:31:FE:22:11
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AE24CFD8DB9252D2F143CBDA6CC8EF423BED8B7C8123867DF1F8FD126DF1B69D
    SPKI SHA256: 6EAFE7079A2FE9845C93FF564DD9256395FBED328D23A5ACCDFCE96DB7ACE46B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-ECC-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Proof.com Document Signing ECC CA 2

- Subject: countryName=US, organizationName=Proof.com, commonName=Proof.com Document Signing ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit RSA CA R1
- Serial: 1FD25BDF2BAD898BCD9994B0BD85EACE
- SHA-256: 3374C0E8FFCA58C137B9A7193FAAC1A73915A443D6A6E31C78D619FA7A902E1C
- SPKI SHA-256: 6C7DEE9AF94FD406EFF61CEBB26533901D631FE44683016890A379A1BFAD6F1D
- Validity: 2023-11-24 to 2031-11-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Proof.com-docSigning-I-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:d2:5b:df:2b:ad:89:8b:cd:99:94:b0:bd:85:ea:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit RSA CA R1
        Validity
            Not Before: Nov 24 15:37:37 2023 GMT
            Not After : Nov 22 15:37:36 2031 GMT
        Subject: C = US, O = Proof.com, CN = Proof.com Document Signing ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C5:7C:D2:40:1E:7F:F8:A6:12:D9:05:B9:52:DB:31:67:64:72:3B:B4
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                8E:33:4B:3C:CF:F2:F2:FC:47:0E:B6:BB:AC:21:DE:47:83:48:16:BC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3374C0E8FFCA58C137B9A7193FAAC1A73915A443D6A6E31C78D619FA7A902E1C
    SPKI SHA256: 6C7DEE9AF94FD406EFF61CEBB26533901D631FE44683016890A379A1BFAD6F1D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Basic TLS DV RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Basic TLS DV RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 0AF338327C1D48BA41753EBEB9EA6029
- SHA-256: FCCF7CE88A642874D1C107F4D10C6A7DD334797639BA98130454562C303AF170
- SPKI SHA-256: 381DC74850F1CA46589190B388903EEA5EA21D86ECA8DAE1148ACC83F2F8E665
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Quantum-DVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:f3:38:32:7c:1d:48:ba:41:75:3e:be:b9:ea:60:29
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb  9 19:22:54 2021 GMT
            Not After : Feb  7 19:22:53 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Basic TLS DV RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                DC:59:4C:DD:E4:72:E8:D3:E7:CA:3B:9D:44:67:3E:CC:3E:63:36:4B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FCCF7CE88A642874D1C107F4D10C6A7DD334797639BA98130454562C303AF170
    SPKI SHA256: 381DC74850F1CA46589190B388903EEA5EA21D86ECA8DAE1148ACC83F2F8E665
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum EV Secure Code Signing CN RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum EV Secure Code Signing CN RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 29FCB8A551FA44F6A9FF05175A684FAC
- SHA-256: 663DEA3F6F286EB1F192EA424B83E18081CE9D0116855623BEDCE8A8140D3A46
- SPKI SHA-256: E8EFE1E4D69622D9E15B8067BFDA606503E71E7942184D2F5D973F4151D3C66F
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sslcom.cn/Quantum-CN-EVcodeSigning-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:ac
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb  9 19:44:33 2021 GMT
            Not After : Feb  7 19:44:32 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum EV Secure Code Signing CN RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://crt.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                6A:79:DC:9A:21:F9:29:19:07:37:CA:26:4C:32:58:47:A3:86:04:B2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 663DEA3F6F286EB1F192EA424B83E18081CE9D0116855623BEDCE8A8140D3A46
    SPKI SHA256: E8EFE1E4D69622D9E15B8067BFDA606503E71E7942184D2F5D973F4151D3C66F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://crt.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crl.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum EV Secure Code Signing RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum EV Secure Code Signing RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 615B1F89280A6776A02327CE3ABCA08A
- SHA-256: FE6702302434EB3371F57B86668E3C582A17BA1B753A7B73D40292007312E571
- SPKI SHA-256: 10AFBC06FAC241FB2ACE41D7DBF5B94ECF775EF171924CC17000CA4EA877EDF4
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Quantum-EVcodeSigning-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:5b:1f:89:28:0a:67:76:a0:23:27:ce:3a:bc:a0:8a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb  9 19:27:22 2021 GMT
            Not After : Feb  7 19:27:21 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum EV Secure Code Signing RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                86:6C:A1:69:1D:9F:44:68:FE:21:1C:BB:17:32:1B:A3:82:7C:EF:B0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FE6702302434EB3371F57B86668E3C582A17BA1B753A7B73D40292007312E571
    SPKI SHA256: 10AFBC06FAC241FB2ACE41D7DBF5B94ECF775EF171924CC17000CA4EA877EDF4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Code Signing CN RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Code Signing CN RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 4E33A3DF038C94BD5611A51814F68CE9
- SHA-256: F1D12FBDA2BC4D6E6A080FB2B9D3D50326891BD2F46137FC173193E8B677AC84
- SPKI SHA-256: 828A7564E72CDCA3C90C32BE8063524872681D836B9D351DB55527A2250DD9CF
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sslcom.cn/Quantum-CN-codeSigning-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:33:a3:df:03:8c:94:bd:56:11:a5:18:14:f6:8c:e9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb  9 19:49:18 2021 GMT
            Not After : Feb  7 19:49:17 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Code Signing CN RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://crt.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                DC:26:E5:28:C0:44:22:4A:9E:0B:4E:6B:02:8E:02:98:69:07:60:BE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F1D12FBDA2BC4D6E6A080FB2B9D3D50326891BD2F46137FC173193E8B677AC84
    SPKI SHA256: 828A7564E72CDCA3C90C32BE8063524872681D836B9D351DB55527A2250DD9CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://crt.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Code Signing RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Code Signing RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 3348510D6AA99654904848A14BE65170
- SHA-256: CC548E5A702717EDF7AF08DB3A64CACF8F85416AA6E761DF01A9C51C4E3ACA90
- SPKI SHA-256: B4B2BC318B6044F059E7E87A304BD1DB98B26C8948827EACE96CD61BCD252ECD
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Quantum-codeSigning-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:48:51:0d:6a:a9:96:54:90:48:48:a1:4b:e6:51:70
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb  9 19:34:39 2021 GMT
            Not After : Feb  7 19:34:38 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Code Signing RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                E9:61:D6:65:08:BA:A0:B9:2A:F5:61:B8:F2:3B:CF:6A:72:CC:16:E5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CC548E5A702717EDF7AF08DB3A64CACF8F85416AA6E761DF01A9C51C4E3ACA90
    SPKI SHA256: B4B2BC318B6044F059E7E87A304BD1DB98B26C8948827EACE96CD61BCD252ECD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Site DV TLS CN RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site DV TLS CN RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 663E22B3F73CCB78DC74369353AB24C3
- SHA-256: E477EDF11EB54F6F2EDD56987B3DBF8AFA6B85507AE792AC63CD41CE41AC1397
- SPKI SHA-256: 899CF4A1AA518CABE6B3295CA83C1BC1CB0119FAE3B52794BEB6EA7966AE165A
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sslcom.cn/Quantum-CN-DVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:3e:22:b3:f7:3c:cb:78:dc:74:36:93:53:ab:24:c3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb  9 19:38:13 2021 GMT
            Not After : Feb  7 19:38:12 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Site DV TLS CN RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://crt.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                66:58:CA:65:DA:77:89:40:56:9D:27:B8:AB:30:14:13:E3:85:A0:F3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E477EDF11EB54F6F2EDD56987B3DBF8AFA6B85507AE792AC63CD41CE41AC1397
    SPKI SHA256: 899CF4A1AA518CABE6B3295CA83C1BC1CB0119FAE3B52794BEB6EA7966AE165A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://crt.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Site EV Pro TLS CN RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site EV Pro TLS CN RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 1EF471B0087B0EF9CC44FAF686E0754E
- SHA-256: 0291CF02849132F714E810C9D0B24DB37BAEABF8CC91781E6C338E141767C39B
- SPKI SHA-256: 19B2B26D2706B0E402F224E170A066A3B97D358C719E7D37783B8A17A022EF1E
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sslcom.cn/Quantum-CN-EVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:f4:71:b0:08:7b:0e:f9:cc:44:fa:f6:86:e0:75:4e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb  9 19:42:08 2021 GMT
            Not After : Feb  7 19:42:07 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Site EV Pro TLS CN RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://crt.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                48:B8:55:97:A2:D8:68:60:27:47:E1:04:C8:BA:8A:09:2B:F0:5C:F7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0291CF02849132F714E810C9D0B24DB37BAEABF8CC91781E6C338E141767C39B
    SPKI SHA256: 19B2B26D2706B0E402F224E170A066A3B97D358C719E7D37783B8A17A022EF1E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://crt.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crl.sslcom.cn/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Site EV TLS RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site EV TLS RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 6D95777AADB16F93954B17750F2DD465
- SHA-256: E836C135661901E0840E887AF6EE516C56550D644990C57BFA60E297C1517FFA
- SPKI SHA-256: F09CA7DFFD0DAEF5B2B42E7402542B3CD61FF12B026A1C69F2DE5AF86F327C23
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Quantum-EVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:95:77:7a:ad:b1:6f:93:95:4b:17:75:0f:2d:d4:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb  9 19:25:31 2021 GMT
            Not After : Feb  7 19:25:30 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Site EV TLS RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                B0:91:B0:17:59:F6:2D:E3:D9:5A:B2:22:81:1C:B2:4E:34:70:3D:94
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E836C135661901E0840E887AF6EE516C56550D644990C57BFA60E297C1517FFA
    SPKI SHA256: F09CA7DFFD0DAEF5B2B42E7402542B3CD61FF12B026A1C69F2DE5AF86F327C23
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Site OV Pro TLS CN RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site OV Pro TLS CN RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 50758BB068C7CA6BF84CC950ABC26539
- SHA-256: 36D19A9CDE6029D14DA4D951735190BB4CC6DB206D643F6474D7739474912299
- SPKI SHA-256: C26921B9C264D24FEEFAF875E79B0DD6C82D7735B9DFBB3F798A9C6DE626E0F5
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.sslcom.cn/Quantum-CN-OVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:75:8b:b0:68:c7:ca:6b:f8:4c:c9:50:ab:c2:65:39
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb  9 19:47:07 2021 GMT
            Not After : Feb  7 19:47:06 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Site OV Pro TLS CN RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://crt.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                F8:DF:32:86:03:81:7E:2F:3B:DB:2C:41:7A:5D:EA:B7:8E:16:7F:0A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 36D19A9CDE6029D14DA4D951735190BB4CC6DB206D643F6474D7739474912299
    SPKI SHA256: C26921B9C264D24FEEFAF875E79B0DD6C82D7735B9DFBB3F798A9C6DE626E0F5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://crt.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crl.sslcom.cn/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Quantum Secure Site OV TLS RSA R1

- Subject: countryName=GB, organizationName=Quantum CA Limited, commonName=Quantum Secure Site OV TLS RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 4EB6AD64EA15BA233C32B0D491670063
- SHA-256: 6D558D22DDD6ED4CA13EE712FD42AF2294F2C9C6D7013C324710FFB8D8F36FA9
- SPKI SHA-256: 84B7FD62138DFB291FF7E69BDEBADDCA190B7BADCF5A322FB2F821AC712720B0
- Validity: 2021-02-09 to 2031-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Quantum-OVTLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:b6:ad:64:ea:15:ba:23:3c:32:b0:d4:91:67:00:63
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb  9 19:30:42 2021 GMT
            Not After : Feb  7 19:30:41 2031 GMT
        Subject: C = GB, O = Quantum CA Limited, CN = Quantum Secure Site OV TLS RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                18:6E:C8:3E:C8:99:B1:E8:8E:A5:FC:25:79:6F:06:F1:F0:0C:31:0D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6D558D22DDD6ED4CA13EE712FD42AF2294F2C9C6D7013C324710FFB8D8F36FA9
    SPKI SHA256: 84B7FD62138DFB291FF7E69BDEBADDCA190B7BADCF5A322FB2F821AC712720B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### S/MIME ECC ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=S/MIME ECC ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 0A95B7518C1CF3F352016CE47EBF5A3C
- SHA-256: 60D355106DD6464F6ABE54FF59CDC68B9C9615E8B715271F57FC996F6CEF21DC
- SPKI SHA-256: 2A72477605A0532056AF52E3367CC014DCD1D2DC1360B65692506E2F4F84A416
- Validity: 2019-12-05 to 2029-12-02
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-SMIME-I-ECC-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:95:b7:51:8c:1c:f3:f3:52:01:6c:e4:7e:bf:5a:3c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec  5 17:55:51 2019 GMT
            Not After : Dec  2 17:55:51 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = S/MIME ECC ICA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                79:0C:C2:5B:39:8D:A9:2E:B6:8B:FE:E3:EE:CD:73:C7:90:2C:D4:82
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 60D355106DD6464F6ABE54FF59CDC68B9C9615E8B715271F57FC996F6CEF21DC
    SPKI SHA256: 2A72477605A0532056AF52E3367CC014DCD1D2DC1360B65692506E2F4F84A416
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### S/MIME RSA ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=S/MIME RSA ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 7D050820AEBA12822E8BF38F1803FE77
- SHA-256: 768D18DFBE35D8FE66712F9877623D1510771B53F5BB819C624A15648F1FE509
- SPKI SHA-256: 9C839A3BAD80C45316D0938A8ECCB50D9B1E968A249D1A937E63B10C47CCD2C4
- Validity: 2019-12-05 to 2029-12-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-SMIME-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:05:08:20:ae:ba:12:82:2e:8b:f3:8f:18:03:fe:77
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec  5 17:47:04 2019 GMT
            Not After : Dec  2 17:47:04 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = S/MIME RSA ICA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                93:68:C5:D0:F4:60:86:BC:60:F6:1B:4B:93:9F:07:D4:8D:F4:99:9B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 768D18DFBE35D8FE66712F9877623D1510771B53F5BB819C624A15648F1FE509
    SPKI SHA256: 9C839A3BAD80C45316D0938A8ECCB50D9B1E968A249D1A937E63B10C47CCD2C4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SafeToOpen ClientCert ICA RSA R1

- Subject: countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen ClientCert ICA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Enterprise Intermediate CA RSA R1
- Serial: 28EEF89670FEC97DF6F02DBEFB78EBF4
- SHA-256: 76348ADEE48E61D7329EE483109651EA4B2E0B5C02F7DF2583FE1074ED9C6FEC
- SPKI SHA-256: 7BDFDB8DFB766F23F4570055C8C950522A887B8AF46119F8FEB2A5FA443756DE
- Validity: 2019-10-01 to 2029-09-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SafeToOpen-clientCert-SubCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:ee:f8:96:70:fe:c9:7d:f6:f0:2d:be:fb:78:eb:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Oct  1 16:03:12 2019 GMT
            Not After : Sep 28 16:03:12 2029 GMT
        Subject: C = NZ, O = SafeToOpen Ltd, CN = SafeToOpen ClientCert ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                17:B6:0F:04:09:52:2A:F0:26:6F:F3:62:70:22:10:DD:B5:2B:F1:B2
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                85:35:CB:E8:4A:2B:C4:5F:EB:DD:F7:91:DB:29:C6:0B:62:7B:BD:95
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 76348ADEE48E61D7329EE483109651EA4B2E0B5C02F7DF2583FE1074ED9C6FEC
    SPKI SHA256: 7BDFDB8DFB766F23F4570055C8C950522A887B8AF46119F8FEB2A5FA443756DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SafeToOpen Code Signing ICA RSA R1

- Subject: countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen Code Signing ICA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Enterprise Intermediate CA RSA R1
- Serial: 6ED1EBDC6E848548035F5D9BCEB27539
- SHA-256: 96FBC8AB4D7053E8704781BABEE89A698F322FCEE2001D1ECDEAE23B5A0DD0D4
- SPKI SHA-256: A63437C0C2F670A12B7DCA3B2C10A25B5D8878C4DDECE3B4BF1B51DCEE0E5099
- Validity: 2019-10-01 to 2029-09-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SafeToOpen-codeSigning-SubCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:d1:eb:dc:6e:84:85:48:03:5f:5d:9b:ce:b2:75:39
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Oct  1 16:07:12 2019 GMT
            Not After : Sep 28 16:07:12 2029 GMT
        Subject: C = NZ, O = SafeToOpen Ltd, CN = SafeToOpen Code Signing ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                44:FA:2E:E6:80:21:A4:46:97:0E:6A:E8:33:BC:53:11:66:4D:A9:B9
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                A0:B8:D4:48:CE:6B:68:DA:86:6F:49:97:6A:B2:17:99:F7:8F:2C:A2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 96FBC8AB4D7053E8704781BABEE89A698F322FCEE2001D1ECDEAE23B5A0DD0D4
    SPKI SHA256: A63437C0C2F670A12B7DCA3B2C10A25B5D8878C4DDECE3B4BF1B51DCEE0E5099
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SafeToOpen EV TLS ICA RSA R1

- Subject: countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen EV TLS ICA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Serial: 40DB370496435E7DF5168EF4F57EFCDA
- SHA-256: C2D4FDFBBD82F4A1CDAC4713E3AB0999560918D7A170DDE03F7DDBF9A288DCDC
- SPKI SHA-256: C1C7A84F249A2C25D8EC500006531AD5E07815CD95A1D73CCD24228FE82DE8AA
- Validity: 2019-10-01 to 2029-09-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SafeToOpen-EV-SSL-SubCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:db:37:04:96:43:5e:7d:f5:16:8e:f4:f5:7e:fc:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Validity
            Not Before: Oct  1 15:55:55 2019 GMT
            Not After : Sep 28 15:55:55 2029 GMT
        Subject: C = NZ, O = SafeToOpen Ltd, CN = SafeToOpen EV TLS ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                A2:99:41:DD:5E:E1:85:38:B8:9D:C3:19:D6:62:1F:9D:43:5C:33:20
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C2D4FDFBBD82F4A1CDAC4713E3AB0999560918D7A170DDE03F7DDBF9A288DCDC
    SPKI SHA256: C1C7A84F249A2C25D8EC500006531AD5E07815CD95A1D73CCD24228FE82DE8AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SafeToOpen TLS ICA RSA R1

- Subject: countryName=NZ, organizationName=SafeToOpen Ltd, commonName=SafeToOpen TLS ICA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 704D7160F41FE68715D4908DE4EE1639
- SHA-256: DFCCDBF077D142D7923F6316DD411E462C7A8BC04781F2B87065A5C5E258A7E0
- SPKI SHA-256: B90E1CCC968986BAE205D23197B4B23F05FC5B2E33D766A3F59A826F799D629A
- Validity: 2019-10-01 to 2029-09-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SafeToOpen-SSL-SubCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:4d:71:60:f4:1f:e6:87:15:d4:90:8d:e4:ee:16:39
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Oct  1 15:59:49 2019 GMT
            Not After : Sep 28 15:59:49 2029 GMT
        Subject: C = NZ, O = SafeToOpen Ltd, CN = SafeToOpen TLS ICA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                92:FB:3B:7E:68:D3:3A:C3:00:76:38:66:0C:8A:5C:BC:95:D2:FD:57
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DFCCDBF077D142D7923F6316DD411E462C7A8BC04781F2B87065A5C5E258A7E0
    SPKI SHA256: B90E1CCC968986BAE205D23197B4B23F05FC5B2E33D766A3F59A826F799D629A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SafeToOpen TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SafeToOpen TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 5B4C57C55B3824192DB725A97AE89E40
- SHA-256: DC60CCEB9795435261548AF2CA959CBBBA67C9B001BEFF8E81EB9C0D3E7D0F8A
- SPKI SHA-256: 212378D5B4E17AF0EEE47B349257FE7F503BC76AE8EF3671382D896956C19C0C
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SafeToOpen-TLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:4c:57:c5:5b:38:24:19:2d:b7:25:a9:7a:e8:9e:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 12:55:52 2026 GMT
            Not After : May 19 12:55:51 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = SafeToOpen TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                BC:B3:CD:43:8B:32:9E:E0:EC:AB:63:42:A7:4D:C6:E3:96:BF:E3:78
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC60CCEB9795435261548AF2CA959CBBBA67C9B001BEFF8E81EB9C0D3E7D0F8A
    SPKI SHA256: 212378D5B4E17AF0EEE47B349257FE7F503BC76AE8EF3671382D896956C19C0C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Sectigo Limited Document Signing RSA CA 1

- Subject: countryName=GB, organizationName=Sectigo Limited, commonName=Sectigo Limited Document Signing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit RSA CA R1
- Serial: 7BE45FDDCC9D708399A76E702458A6F0
- SHA-256: C469ACE2826093F68C35E918ED45C3B5C02BB6CDBBC5D07F831075DD0A34F063
- SPKI SHA-256: 4DEC8D453E86C89960B1906FCABAAC873BE4E34B689CA64079FED921B89C1624
- Validity: 2025-11-19 to 2033-11-17
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Sectigo-docSigning-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:e4:5f:dd:cc:9d:70:83:99:a7:6e:70:24:58:a6:f0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit RSA CA R1
        Validity
            Not Before: Nov 19 22:17:15 2025 GMT
            Not After : Nov 17 22:17:14 2033 GMT
        Subject: C = GB, O = Sectigo Limited, CN = Sectigo Limited Document Signing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C5:7C:D2:40:1E:7F:F8:A6:12:D9:05:B9:52:DB:31:67:64:72:3B:B4
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                0F:0C:0D:50:36:22:95:96:94:B3:4E:51:B0:B7:98:0D:90:C3:80:05
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C469ACE2826093F68C35E918ED45C3B5C02BB6CDBBC5D07F831075DD0A34F063
    SPKI SHA256: 4DEC8D453E86C89960B1906FCABAAC873BE4E34B689CA64079FED921B89C1624
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Sectigo Limited VMC Issuing RSA CA 1

- Subject: countryName=GB, organizationName=Sectigo Limited, commonName=Sectigo Limited VMC Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC RSA Root CA 2024
- Serial: 6647877532869CAD5D6424638D9FBEA1
- SHA-256: 600EE4992BC587EBB1B66A15CF26BB0FAE213235A8F2477EF18D6460681AA5E0
- SPKI SHA-256: 53C1B8C320A4BA02F5383257DF86D3CBE8F67C470721D29EC2570B670E8CC4D2
- Validity: 2025-11-13 to 2035-11-11
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Sectigo-VMC-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:47:87:75:32:86:9c:ad:5d:64:24:63:8d:9f:be:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com VMC RSA Root CA 2024
        Validity
            Not Before: Nov 13 15:25:41 2025 GMT
            Not After : Nov 11 15:25:40 2035 GMT
        Subject: C = GB, O = Sectigo Limited, CN = Sectigo Limited VMC Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C1:35:A2:F4:59:D9:07:76:97:FD:CA:E8:6B:77:D6:26:AE:7A:5A:FB
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-VMC-Root-2024-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Brand Indicator for Message Identification
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
            X509v3 Subject Key Identifier:
                88:24:A8:65:B8:67:36:67:A9:CD:C4:EC:87:FD:E0:1E:75:14:5E:9A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 600EE4992BC587EBB1B66A15CF26BB0FAE213235A8F2477EF18D6460681AA5E0
    SPKI SHA256: 53C1B8C320A4BA02F5383257DF86D3CBE8F67C470721D29EC2570B670E8CC4D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-VMC-Root-2024-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak Client Authentication ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak Client Authentication ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit ECC CA R1
- Serial: 016ADD74FCD311AD356346AC9BA58502
- SHA-256: E422B4C43625948E38679A0425A11A3F8DD6A5FA20D2A8C878BE88BAD7266B43
- SPKI SHA-256: ACED62F70CB4C1B39846E647779EE63F583D3C1AB2BD494E689460A23419961A
- Validity: 2025-09-23 to 2035-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-clientAuth-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-clientAuth-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:6a:dd:74:fc:d3:11:ad:35:63:46:ac:9b:a5:85:02
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corp, CN = SSL.com Client Authentication Transit ECC CA R1
        Validity
            Not Before: Sep 23 09:35:40 2025 GMT
            Not After : Sep 21 09:35:39 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak Client Authentication ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B2:D4:E9:AF:27:FA:6F:D1:83:88:C6:AB:6E:3C:94:FF:C3:B8:0C:DE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-clientAuth-T-ECC-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-clientAuth-T-ECC-R1.crl
            X509v3 Subject Key Identifier:
                82:2C:D2:0A:EE:20:04:09:53:13:CA:F9:26:54:7C:A7:72:84:DD:CE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E422B4C43625948E38679A0425A11A3F8DD6A5FA20D2A8C878BE88BAD7266B43
    SPKI SHA256: ACED62F70CB4C1B39846E647779EE63F583D3C1AB2BD494E689460A23419961A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-clientAuth-T-ECC-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-clientAuth-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak Client Authentication RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak Client Authentication RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit RSA CA R1
- Serial: 1DFE9FC141678BF3A50936C11A771E80
- SHA-256: D5A9C2929C633BD26FFDEB85ACCD6C59F8C99EE048CFC5A6839C674D1069F887
- SPKI SHA-256: 44E8123FA982F7886168E1A6B4A3CEC55E4694EC8B91279A917146070A9866D1
- Validity: 2025-09-23 to 2035-09-21
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-clientAuth-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:fe:9f:c1:41:67:8b:f3:a5:09:36:c1:1a:77:1e:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corp, CN = SSL.com Client Authentication Transit RSA CA R1
        Validity
            Not Before: Sep 23 09:34:01 2025 GMT
            Not After : Sep 21 09:34:00 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak Client Authentication RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                30:09:7D:12:4F:0C:0F:DE:61:8F:A8:4A:E1:6A:06:FE:AE:33:D0:5F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-clientAuth-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                94:AA:F3:F2:25:93:89:7B:F7:C0:98:D5:76:BA:8D:A6:F1:A2:19:22
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D5A9C2929C633BD26FFDEB85ACCD6C59F8C99EE048CFC5A6839C674D1069F887
    SPKI SHA256: 44E8123FA982F7886168E1A6B4A3CEC55E4694EC8B91279A917146070A9866D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-clientAuth-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak Document Signing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak Document Signing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit ECC CA R2
- Serial: 125FB6267E867E359164260E172C61D7
- SHA-256: 8F4DCBA1F8F9414E625EEA8B4622FF4D144EC962561DF65B966B93FF51266A53
- SPKI SHA-256: 939F644E4805CB355586B269D9F98C2EBF5ADCEFD192DA3E832755101E72781F
- Validity: 2025-09-23 to 2033-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-docSigning-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:5f:b6:26:7e:86:7e:35:91:64:26:0e:17:2c:61:d7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing Transit ECC CA R2
        Validity
            Not Before: Sep 23 09:48:15 2025 GMT
            Not After : Sep 21 09:48:14 2033 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak Document Signing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                E3:74:6E:01:A9:0D:16:9A:EE:08:F5:BC:F3:37:DD:BF:CA:43:07:87
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                E6:BD:80:EE:28:BA:D6:5E:2F:27:A8:C2:89:A2:8B:69:59:91:72:44
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8F4DCBA1F8F9414E625EEA8B4622FF4D144EC962561DF65B966B93FF51266A53
    SPKI SHA256: 939F644E4805CB355586B269D9F98C2EBF5ADCEFD192DA3E832755101E72781F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak Document Signing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak Document Signing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit RSA CA R2
- Serial: 106AE9484D1A9656DB5C1CCF1780F6A7
- SHA-256: E92A1377F228636354E98012E392195F95597508C212CB889C24206EC44CD331
- SPKI SHA-256: 0C81F121D66A03199469E6351A4985AB2A92AF1603672809CED7B41C3029D21A
- Validity: 2025-09-23 to 2033-09-21
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-docSigning-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:6a:e9:48:4d:1a:96:56:db:5c:1c:cf:17:80:f6:a7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing Transit RSA CA R2
        Validity
            Not Before: Sep 23 09:47:14 2025 GMT
            Not After : Sep 21 09:47:13 2033 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak Document Signing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                88:41:20:FC:3F:A5:57:CF:64:86:22:AB:26:37:21:6E:18:FC:6F:B4
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                17:57:77:CE:64:73:85:F8:E3:08:05:5B:C8:0F:67:11:69:66:8C:D6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E92A1377F228636354E98012E392195F95597508C212CB889C24206EC44CD331
    SPKI SHA256: 0C81F121D66A03199469E6351A4985AB2A92AF1603672809CED7B41C3029D21A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak EV TLS ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak EV TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit ECC CA R2
- Serial: 75910C1B24F50BFA77DADD9B65DE3EA0
- SHA-256: 4A6C3073858201B08CF11556250F541877DE08FFFCDEEDF203FBB198A458F2F3
- SPKI SHA-256: 168417346E7DAFAB16C27C3896332F0CE3C276DE0BDEC226741F01A188473CA3
- Validity: 2025-09-23 to 2035-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-EVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:91:0c:1b:24:f5:0b:fa:77:da:dd:9b:65:de:3e:a0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit ECC CA R2
        Validity
            Not Before: Sep 23 09:32:42 2025 GMT
            Not After : Sep 21 09:32:41 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak EV TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                37:30:1E:64:2D:19:68:F3:FD:6E:B1:72:0D:EF:6C:FB:0A:40:4C:90
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-EVTLS-T-ECC-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                DA:EF:48:58:B8:45:91:1C:2B:3A:EF:16:1B:27:7C:EE:67:32:19:FD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4A6C3073858201B08CF11556250F541877DE08FFFCDEEDF203FBB198A458F2F3
    SPKI SHA256: 168417346E7DAFAB16C27C3896332F0CE3C276DE0BDEC226741F01A188473CA3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-EVTLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Securepeak EV TLS RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak EV TLS RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit RSA CA R2
- Serial: 1DDA0D95B6E5DA05EABB12879C47FA46
- SHA-256: 653A17149C7F289AF650D39DF991C3FA72843CDE3F399644E0A86DF73B3B0556
- SPKI SHA-256: 217492E35B03DD02BE84A3E2E3A3E68D75FB6D200797BC00750A19423E71418E
- Validity: 2025-09-23 to 2035-09-21
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-EVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:da:0d:95:b6:e5:da:05:ea:bb:12:87:9c:47:fa:46
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit RSA CA R2
        Validity
            Not Before: Sep 23 09:31:35 2025 GMT
            Not After : Sep 21 09:31:34 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak EV TLS RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:0D:2F:A5:FA:75:F5:3A:F1:DF:EE:63:0B:D3:2C:27:CA:03:4F:75
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-EVTLS-T-RSA-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                6D:92:43:A4:4B:6F:10:99:E6:61:56:A3:76:99:AF:DB:6E:8F:3C:FA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 653A17149C7F289AF650D39DF991C3FA72843CDE3F399644E0A86DF73B3B0556
    SPKI SHA256: 217492E35B03DD02BE84A3E2E3A3E68D75FB6D200797BC00750A19423E71418E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-EVTLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Securepeak S/MIME ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak S/MIME ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit ECC CA R2
- Serial: 35518D9366F01CFC280674F2DF5E9E4D
- SHA-256: 393BFC0E613DD8D3B00C8ED2AE322E9672FED9DD5EA1146CDAB4722C1B1236B9
- SPKI SHA-256: 0348E07B52117D33574BC47EE06CACAAFE8B202ED832E057659E990DDCA7BDF7
- Validity: 2025-09-23 to 2033-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-SMIME-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-SMIME-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:51:8d:93:66:f0:1c:fc:28:06:74:f2:df:5e:9e:4d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com S/MIME Transit ECC CA R2
        Validity
            Not Before: Sep 23 09:50:22 2025 GMT
            Not After : Sep 21 09:50:21 2033 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak S/MIME ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                6F:52:2C:15:1F:D3:28:2B:BF:DB:8D:EF:04:25:BF:40:F1:BC:C2:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-SMIME-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-SMIME-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                18:A6:F3:98:7C:E5:BC:92:6B:61:48:B0:15:39:CD:FE:84:1C:E9:12
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 393BFC0E613DD8D3B00C8ED2AE322E9672FED9DD5EA1146CDAB4722C1B1236B9
    SPKI SHA256: 0348E07B52117D33574BC47EE06CACAAFE8B202ED832E057659E990DDCA7BDF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-SMIME-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-SMIME-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak S/MIME RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak S/MIME RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit RSA CA R2
- Serial: 2815EE3B2250618A01AB3E0812B11EC7
- SHA-256: F3B442B4DA351569D68FBB2F0C91C6EDC89E0FE929FDB45F9A39168067791810
- SPKI SHA-256: 1AAB0A8AA5C6E1596FEEEDF70DA3422260026F7D966829EE2AD749969F9060F0
- Validity: 2025-09-23 to 2033-09-21
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-SMIME-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:15:ee:3b:22:50:61:8a:01:ab:3e:08:12:b1:1e:c7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com S/MIME Transit RSA CA R2
        Validity
            Not Before: Sep 23 09:49:20 2025 GMT
            Not After : Sep 21 09:49:19 2033 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak S/MIME RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F8:73:64:82:77:12:8C:7E:A4:3D:6A:05:0A:58:FF:AA:E8:51:B6:39
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-SMIME-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                0B:D9:EA:F1:B2:8C:F2:0E:6E:34:D1:01:2D:8F:3F:1E:C3:D4:21:10
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F3B442B4DA351569D68FBB2F0C91C6EDC89E0FE929FDB45F9A39168067791810
    SPKI SHA256: 1AAB0A8AA5C6E1596FEEEDF70DA3422260026F7D966829EE2AD749969F9060F0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-SMIME-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak TLS ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 3A4A713C27D2245F2F901EF5D5324531
- SHA-256: 188453098727A92CB11C905E0BB6A367B2BD2A9A8B2BF82C70735743DFA550FF
- SPKI SHA-256: BCFA6C5EA59F9D47F3AAC1A64AA61E1DF534C735AB4BF4E2A70BDD02A401B066
- Validity: 2025-09-23 to 2035-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-TLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:4a:71:3c:27:d2:24:5f:2f:90:1e:f5:d5:32:45:31
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: Sep 23 09:30:08 2025 GMT
            Not After : Sep 21 09:30:07 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                7C:AB:8B:8B:7F:87:BD:B2:22:1E:C9:32:1C:09:96:F0:B6:87:BF:AE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 188453098727A92CB11C905E0BB6A367B2BD2A9A8B2BF82C70735743DFA550FF
    SPKI SHA256: BCFA6C5EA59F9D47F3AAC1A64AA61E1DF534C735AB4BF4E2A70BDD02A401B066
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Securepeak TLS RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Securepeak TLS RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 5DB634629D3ABE01EFDD2BC71EB3EB22
- SHA-256: 6A41AB879A38EE1B254D5B87AAA2DECD7EE6851DCA30CE47CD848DA1E68FC52E
- SPKI SHA-256: B7BD11B3BA48614ECB3E473C602536DD930C8938E9A2DB4E2E4E29B710BD36AB
- Validity: 2025-09-23 to 2035-09-21
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securepeak-TLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5d:b6:34:62:9d:3a:be:01:ef:dd:2b:c7:1e:b3:eb:22
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: Sep 23 09:28:38 2025 GMT
            Not After : Sep 21 09:28:37 2035 GMT
        Subject: C = US, O = SSL Corporation, CN = Securepeak TLS RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                C9:8F:6A:BF:D2:BC:DA:22:88:52:F7:33:E5:5F:0A:A0:4F:B6:6D:1A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6A41AB879A38EE1B254D5B87AAA2DECD7EE6851DCA30CE47CD848DA1E68FC52E
    SPKI SHA256: B7BD11B3BA48614ECB3E473C602536DD930C8938E9A2DB4E2E4E29B710BD36AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SecureTrust Client Authentication CA, Level 1

- Subject: commonName=SecureTrust Client Authentication CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 06F1EC00ECC1441C0B549CD9813EE9C80758A7
- SHA-256: 2F50860F968053A7DBA17851341759B0D5C0412F857A2CD19F3731DD3BED1B6B
- SPKI SHA-256: 9B034F981E2EAA0957F4C4C4CACB66ED213A1084EF1FB13E8FCCC09AAA36E3CF
- Validity: 2019-01-29 to 2029-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STCLCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:ec:c1:44:1c:0b:54:9c:d9:81:3e:e9:c8:07:58:a7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Jan 29 12:59:59 2029 GMT
        Subject: CN = "SecureTrust Client Authentication CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                DD:68:0E:59:C7:C1:0E:A3:78:D0:AB:94:96:63:4A:06:50:50:3E:21
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2F50860F968053A7DBA17851341759B0D5C0412F857A2CD19F3731DD3BED1B6B
    SPKI SHA256: 9B034F981E2EAA0957F4C4C4CACB66ED213A1084EF1FB13E8FCCC09AAA36E3CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Code Signing CA, Level 1

- Subject: commonName=SecureTrust Code Signing CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 06F1EC00EA683A27E3535785192E2A382D0935
- SHA-256: 5E4FF34628DABED6859BACF2E128A807A08F49B0C259D9BE2E33FEE066AC7AF7
- SPKI SHA-256: A9662A254EF7287A0EFF32024A422BD0CED058AF3836721919184BBD12C7A1C7
- Validity: 2019-01-29 to 2029-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STCSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:ea:68:3a:27:e3:53:57:85:19:2e:2a:38:2d:09:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Jan 29 12:59:59 2029 GMT
        Subject: CN = "SecureTrust Code Signing CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                9D:BA:7F:8F:D3:D5:62:49:02:E9:D6:CE:24:49:9D:0C:4C:7C:0F:9A
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5E4FF34628DABED6859BACF2E128A807A08F49B0C259D9BE2E33FEE066AC7AF7
    SPKI SHA256: A9662A254EF7287A0EFF32024A422BD0CED058AF3836721919184BBD12C7A1C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Domain Validation CA, Level 1

- Subject: commonName=SecureTrust Domain Validation CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 06F1EC00E80B1BAF9870A7C4B6CBE401A32D68
- SHA-256: 5E60965804461930AC27B6DBE3445679EAE4131C22AFB88AF7ACF6A1917B5ABA
- SPKI SHA-256: DCC27B9201F8006FA2A7A08CCC80537987BD5FEF5D4B116309B9C422E6099560
- Validity: 2019-01-29 to 2029-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STDVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:e8:0b:1b:af:98:70:a7:c4:b6:cb:e4:01:a3:2d:68
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Jan 29 12:59:59 2029 GMT
        Subject: CN = "SecureTrust Domain Validation CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                62:DE:AD:7A:17:DE:7C:B7:C3:7C:23:17:A3:B1:26:E5:46:D7:3A:F4
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5E60965804461930AC27B6DBE3445679EAE4131C22AFB88AF7ACF6A1917B5ABA
    SPKI SHA256: DCC27B9201F8006FA2A7A08CCC80537987BD5FEF5D4B116309B9C422E6099560
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Extended Validation CA, Level 1

- Subject: commonName=SecureTrust Extended Validation CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 06F1EC00E31E46D341B2B2633CE480D915F81D
- SHA-256: DD23355C61D59970423004729795CAEF77AFDB39767A795740D4E04CB6158A99
- SPKI SHA-256: 0DFAEC99FB8CE508D4A3305EA99EF9AB26C9C040F04481BAE034F23372B1E568
- Validity: 2019-01-29 to 2029-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STEVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:e3:1e:46:d3:41:b2:b2:63:3c:e4:80:d9:15:f8:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Jan 29 12:59:59 2029 GMT
        Subject: CN = "SecureTrust Extended Validation CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                03:AB:80:C6:55:0A:2A:95:A1:E0:D7:FE:1A:E6:C0:CA:78:CC:B0:96
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DD23355C61D59970423004729795CAEF77AFDB39767A795740D4E04CB6158A99
    SPKI SHA256: 0DFAEC99FB8CE508D4A3305EA99EF9AB26C9C040F04481BAE034F23372B1E568
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Organization Validation CA, Level 1

- Subject: commonName=SecureTrust Organization Validation CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 06F1EC00E58E9ADD372C871D25843FDAB852D9
- SHA-256: 11D9330D1A2398508DD50D3094EB28B1B44900D9928F8C22B25EF7A781BDB403
- SPKI SHA-256: 9DAC686EF76F471AD46F1A261F08FCD65E4BE26D2F6686EA508BB1A398705106
- Validity: 2019-01-29 to 2029-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STOVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:e5:8e:9a:dd:37:2c:87:1d:25:84:3f:da:b8:52:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Jan 29 12:59:59 2029 GMT
        Subject: CN = "SecureTrust Organization Validation CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                7F:42:E3:48:6E:58:E9:2E:B9:61:C8:6A:77:B4:F7:03:B8:CD:6A:5A
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11D9330D1A2398508DD50D3094EB28B1B44900D9928F8C22B25EF7A781BDB403
    SPKI SHA256: 9DAC686EF76F471AD46F1A261F08FCD65E4BE26D2F6686EA508BB1A398705106
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Secure Email CA, Level 1

- Subject: commonName=SecureTrust Secure Email CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 06F1EC00EF15830A53C51AC012ABA0741E7414
- SHA-256: 1A948CB5E91C7907430930458891A65A0FAAFE8FB3AF07824AB637F220F66D29
- SPKI SHA-256: 0463B6ED0147EAB366F60AFDE2143FA70A6BCB6DBBC16B724DA79CF599C040C3
- Validity: 2019-01-29 to 2029-01-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:ef:15:83:0a:53:c5:1a:c0:12:ab:a0:74:1e:74:14
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Jan 29 12:59:59 2029 GMT
        Subject: CN = "SecureTrust Secure Email CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Key Identifier:
                B0:A5:4C:C4:7D:9D:20:4B:6E:83:16:17:14:6C:7B:03:48:2C:21:71
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1A948CB5E91C7907430930458891A65A0FAAFE8FB3AF07824AB637F220F66D29
    SPKI SHA256: 0463B6ED0147EAB366F60AFDE2143FA70A6BCB6DBBC16B724DA79CF599C040C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Secure Email CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust Secure Email CA, Level 2
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 072D823CA9F695EE7F7068D3E450040C28AE35
- SHA-256: FC2B3B473BF00DD6110707B622F1727E20EE5665F64ED968AD1DAFCDA5C2787C
- SPKI SHA-256: 7617F1B31A8C96E013D24CEF8111228643EAF5B0F09A8A848CA2FCD99A57D2A8
- Validity: 2020-09-21 to 2030-09-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:a9:f6:95:ee:7f:70:68:d3:e4:50:04:0c:28:ae:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust Secure Email CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                29:DD:29:B3:0E:68:BB:9A:65:C9:AB:EF:FF:05:DA:25:27:82:4A:52
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FC2B3B473BF00DD6110707B622F1727E20EE5665F64ED968AD1DAFCDA5C2787C
    SPKI SHA256: 7617F1B31A8C96E013D24CEF8111228643EAF5B0F09A8A848CA2FCD99A57D2A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Secure Email CA, Level 3

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust Secure Email CA, Level 3
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 072F30E9C81F89F30ADBC4B91764A4102B5253
- SHA-256: C9B767E33B955785458F569746D489B9A51C72B8160212B5DD5C9978125ED492
- SPKI SHA-256: 001CD2BD1082AD8219FD63FB32D6AF300BA0B8F0B61EEC9D06B84BA698DAA752
- Validity: 2020-10-08 to 2030-10-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STSMCA_L3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:c8:1f:89:f3:0a:db:c4:b9:17:64:a4:10:2b:52:53
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Oct  8 06:49:41 2020 GMT
            Not After : Oct  8 06:48:41 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust Secure Email CA, Level 3"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                F3:C9:C3:21:B6:96:67:B3:AC:BD:B9:A0:62:28:1C:EE:5B:87:C2:BF
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C9B767E33B955785458F569746D489B9A51C72B8160212B5DD5C9978125ED492
    SPKI SHA256: 001CD2BD1082AD8219FD63FB32D6AF300BA0B8F0B61EEC9D06B84BA698DAA752
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust Timestamping CA, Level 1

- Subject: commonName=SecureTrust Timestamping CA, Level 1, organizationName=SecureTrust, localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 06F1EC00F16EF831AA0E01A139AED1410AD65D
- SHA-256: 090DF1220A60E8E865F8607B9A24BC3BE00D933D438FB686A3173DEFC5BFBB40
- SPKI SHA-256: 8F63F567498B4A9E0602805E7AC31F9E3FFF9D95840737533E35D02ACD77E6E6
- Validity: 2019-01-29 to 2034-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/STTSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:f1:ec:00:f1:6e:f8:31:aa:0e:01:a1:39:ae:d1:41:0a:d6:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 29 12:59:59 2019 GMT
            Not After : Dec 31 18:59:59 2034 GMT
        Subject: CN = "SecureTrust Timestamping CA, Level 1", O = SecureTrust, L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Subject Key Identifier:
                F8:9D:2A:37:67:28:C2:FC:51:53:33:48:29:93:3A:1F:91:27:45:4F
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 090DF1220A60E8E865F8607B9A24BC3BE00D933D438FB686A3173DEFC5BFBB40
    SPKI SHA256: 8F63F567498B4A9E0602805E7AC31F9E3FFF9D95840737533E35D02ACD77E6E6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### SecureTrust TWG Client CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Client CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 072D823C9B13C405F0A9C4032E332FF439C838
- SHA-256: 729C7C2819CA196EC3C7E197C32FD930E8FE8B2FF8C78734A03B79535813E186
- SPKI SHA-256: F15CF71810752540A5F3DF2EB739F63AC6380C182D85154324F37F4C85608360
- Validity: 2020-09-21 to 2030-09-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:9b:13:c4:05:f0:a9:c4:03:2e:33:2f:f4:39:c8:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG Client CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                EF:11:7D:B6:53:D7:85:C3:F5:D3:4F:B1:FD:0D:42:1E:6E:DB:AA:86
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 729C7C2819CA196EC3C7E197C32FD930E8FE8B2FF8C78734A03B79535813E186
    SPKI SHA256: F15CF71810752540A5F3DF2EB739F63AC6380C182D85154324F37F4C85608360
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG Client CA, Level 3

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Client CA, Level 3
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 072F30E9BC42195A9C341C078AE5326472E02D
- SHA-256: 5B78E6B05F0739429C50CDDEF3DBDC8813A456AB9619E82CF591392A9D0D3B26
- SPKI SHA-256: A0607492A8C5BE7E965CA4EFB0212E5D337CE7F675FC4FDD58297FBF5C8BA38B
- Validity: 2020-10-08 to 2030-10-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGCLCA_L3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:bc:42:19:5a:9c:34:1c:07:8a:e5:32:64:72:e0:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Oct  8 06:49:40 2020 GMT
            Not After : Oct  8 06:48:40 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG Client CA, Level 3"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                74:FD:E0:11:10:62:6F:F5:09:8B:8F:0F:65:A1:AF:A5:DF:0B:F0:73
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5B78E6B05F0739429C50CDDEF3DBDC8813A456AB9619E82CF591392A9D0D3B26
    SPKI SHA256: A0607492A8C5BE7E965CA4EFB0212E5D337CE7F675FC4FDD58297FBF5C8BA38B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-256 Client CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Client CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 072D823C9F7DC8DB045F3361A79498CA80DAD5
- SHA-256: 435EEEB914C2B19C8077E064B0902030B69258015C31F9CE493447686640F0A4
- SPKI SHA-256: C34BE68A5F1EE82191C5B8F10A64118E06FCAD03A2AEF930639B015FE4D07260
- Validity: 2020-09-21 to 2030-09-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:9f:7d:c8:db:04:5f:33:61:a7:94:98:ca:80:da:d5
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-256 Client CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                B0:FE:3C:29:A8:64:6C:CC:AD:FD:A4:12:10:92:13:7E:FA:9E:16:B8
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 435EEEB914C2B19C8077E064B0902030B69258015C31F9CE493447686640F0A4
    SPKI SHA256: C34BE68A5F1EE82191C5B8F10A64118E06FCAD03A2AEF930639B015FE4D07260
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-256 Client CA, Level 3

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Client CA, Level 3
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 072F30E9BE851E409A4D91D1AE9F0319EB35B6
- SHA-256: E92BE3F7D2A0FF65927B92EFB65B31BDDADB070999F8D6AA81273D9F90695C7B
- SPKI SHA-256: 353599D8AD5C14B35533FE77294F7ACDA9D5F17CD8329266C61DA31DC11D640A
- Validity: 2020-10-08 to 2030-10-08
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2CLCA_L3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:be:85:1e:40:9a:4d:91:d1:ae:9f:03:19:eb:35:b6
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Oct  8 06:49:40 2020 GMT
            Not After : Oct  8 06:48:40 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-256 Client CA, Level 3"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                E7:E4:F2:36:0B:70:02:FE:58:C0:B7:0B:87:05:1C:01:0E:1A:6D:B3
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: E92BE3F7D2A0FF65927B92EFB65B31BDDADB070999F8D6AA81273D9F90695C7B
    SPKI SHA256: 353599D8AD5C14B35533FE77294F7ACDA9D5F17CD8329266C61DA31DC11D640A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-256 Secure Email CA, Level 1

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Secure Email CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 072D823CA63B65EE53A536A203E94ABC9F1EA0
- SHA-256: DB83E0E21E77588E7B532F273CD9501C6F0C3D99F7E3899F9D8F3B0D75D22DBD
- SPKI SHA-256: B25DFF45D4EB466C0FE1543C961E430156490987F201E373DF624E982DAC231F
- Validity: 2020-09-21 to 2030-09-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:a6:3b:65:ee:53:a5:36:a2:03:e9:4a:bc:9f:1e:a0
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-256 Secure Email CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                8A:15:D0:B4:EC:7F:69:7D:46:5D:77:25:26:AB:F4:FF:68:65:45:96
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: DB83E0E21E77588E7B532F273CD9501C6F0C3D99F7E3899F9D8F3B0D75D22DBD
    SPKI SHA256: B25DFF45D4EB466C0FE1543C961E430156490987F201E373DF624E982DAC231F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-256 Secure Email CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-256 Secure Email CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 072F30E9C4627001DECFEBF6BF5D3B1066D7E3
- SHA-256: B36BE2E3F72EC3FA03B2273EFF994F4F6F4F09B2DD7A28AF951BD38EC103F088
- SPKI SHA-256: D5434EFEDEFBBD8F6C191218DE4A50BDE597BE6E3362D783426009345DE22557
- Validity: 2020-10-08 to 2030-10-08
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2SMCA_L2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:c4:62:70:01:de:cf:eb:f6:bf:5d:3b:10:66:d7:e3
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Oct  8 06:49:41 2020 GMT
            Not After : Oct  8 06:48:41 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-256 Secure Email CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                73:10:DA:7C:23:42:BF:2D:14:77:C1:22:6C:4C:ED:CB:7C:95:B0:58
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: B36BE2E3F72EC3FA03B2273EFF994F4F6F4F09B2DD7A28AF951BD38EC103F088
    SPKI SHA256: D5434EFEDEFBBD8F6C191218DE4A50BDE597BE6E3362D783426009345DE22557
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-384 Client CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Client CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 072D823CA0A5E3A170B86D6B02D53218345076
- SHA-256: 397D802B65AFBF7E8F03D83A5F81013DAFF9638B07D9CD0A0AB9EA01A66FD395
- SPKI SHA-256: C593BD509B5E9C081E67CA4F3A1AD777964099C2293293E29B42019AC709D5E7
- Validity: 2020-09-21 to 2030-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:a0:a5:e3:a1:70:b8:6d:6b:02:d5:32:18:34:50:76
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-384 Client CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                A8:38:F6:25:6D:AA:2E:F5:DC:7B:0D:3E:D5:AF:EF:AA:0B:24:09:0E
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 397D802B65AFBF7E8F03D83A5F81013DAFF9638B07D9CD0A0AB9EA01A66FD395
    SPKI SHA256: C593BD509B5E9C081E67CA4F3A1AD777964099C2293293E29B42019AC709D5E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-384 Client CA, Level 3

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Client CA, Level 3
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 072F30E9BFB925D6901B7D20616D9C049D4350
- SHA-256: 96CC051C0841630A05FD7F274F6EFB723F857B8B8CFFC0676765C1013100D22D
- SPKI SHA-256: B3A204F40C3FF6CB379C5D2F715DB608FE7A85637C965C571A6130E9B0CF927E
- Validity: 2020-10-08 to 2030-10-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3CLCA_L3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:bf:b9:25:d6:90:1b:7d:20:61:6d:9c:04:9d:43:50
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Oct  8 06:49:40 2020 GMT
            Not After : Oct  8 06:48:40 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-384 Client CA, Level 3"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                6C:8E:B5:B5:71:30:D4:E0:EA:9B:FC:92:FD:BC:95:92:DE:01:45:C7
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 96CC051C0841630A05FD7F274F6EFB723F857B8B8CFFC0676765C1013100D22D
    SPKI SHA256: B3A204F40C3FF6CB379C5D2F715DB608FE7A85637C965C571A6130E9B0CF927E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-384 Secure Email CA, Level 1

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Secure Email CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 072D823CA760E6303B8245C1D6630EDC13C018
- SHA-256: BC129EB22959BD5A8C980E4DA4116C4ABD4A36D3A3649F52CCF4A60D6DEDF4C2
- SPKI SHA-256: 029BD65C743C5CF5315922813CD0443432729E39B7C5634235D7DE29ABC14C49
- Validity: 2020-09-21 to 2030-09-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:a7:60:e6:30:3b:82:45:c1:d6:63:0e:dc:13:c0:18
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-384 Secure Email CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                57:B0:48:70:8F:26:9E:17:3E:74:06:09:5F:D5:23:E3:E2:CC:D7:A1
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BC129EB22959BD5A8C980E4DA4116C4ABD4A36D3A3649F52CCF4A60D6DEDF4C2
    SPKI SHA256: 029BD65C743C5CF5315922813CD0443432729E39B7C5634235D7DE29ABC14C49
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG ECDSA P-384 Secure Email CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG ECDSA P-384 Secure Email CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 072F30E9C58D91DEF98A7F9EB2666CFE7BE1EE
- SHA-256: 136A05614FDE8F94D8C1209B853F8F7FC487D233A280BD9902335DDB563EFDC5
- SPKI SHA-256: AA0421DDF5A44BD3D3A382A347723164B7618E40C86875DAC71D1E555DDA8E96
- Validity: 2020-10-08 to 2030-10-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3SMCA_L2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:c5:8d:91:de:f9:8a:7f:9e:b2:66:6c:fe:7b:e1:ee
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Oct  8 06:49:41 2020 GMT
            Not After : Oct  8 06:48:41 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG ECDSA P-384 Secure Email CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                25:DD:F1:C9:4A:7A:E8:43:FA:2F:D8:42:9A:44:6B:58:07:14:DA:6C
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 136A05614FDE8F94D8C1209B853F8F7FC487D233A280BD9902335DDB563EFDC5
    SPKI SHA256: AA0421DDF5A44BD3D3A382A347723164B7618E40C86875DAC71D1E555DDA8E96
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG Secure Email CA, Level 1

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Secure Email CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 072D823CA4019852119FB8B0E44D32AFDA2D71
- SHA-256: 15166E3B071EC2E2D28B8571E298D89B2426F2A904EBFA0835585FFD924585C1
- SPKI SHA-256: C229253CE2B0D6CE163AAE0593663C42BB65F9FCB701C1658E3AB09A5B4D642C
- Validity: 2020-09-21 to 2030-09-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2d:82:3c:a4:01:98:52:11:9f:b8:b0:e4:4d:32:af:da:2d:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Sep 21 07:44:25 2020 GMT
            Not After : Sep 21 07:43:25 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG Secure Email CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                D8:00:16:AA:11:9A:F5:02:39:9C:B2:B1:68:5B:26:CA:C7:A1:1B:85
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 15166E3B071EC2E2D28B8571E298D89B2426F2A904EBFA0835585FFD924585C1
    SPKI SHA256: C229253CE2B0D6CE163AAE0593663C42BB65F9FCB701C1658E3AB09A5B4D642C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SecureTrust TWG Secure Email CA, Level 2

- Subject: countryName=US, organizationName=SecureTrust, commonName=SecureTrust TWG Secure Email CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 072F30E9C25181828DAC4F5F7DE4AFC87AD132
- SHA-256: ACCCAAF77372FFD2BD7BB21861B224EE1DAE8FE640D03A8FDE7518EC9B32508B
- SPKI SHA-256: A1746B0C366F34747CE1B5AF41B6D19FE1E77DC1ECCFC86EB3A47A6530D06AA1
- Validity: 2020-10-08 to 2030-10-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGSMCA_L2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.securetrust.com/
- CRL DP: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:2f:30:e9:c2:51:81:82:8d:ac:4f:5f:7d:e4:af:c8:7a:d1:32
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Oct  8 06:49:40 2020 GMT
            Not After : Oct  8 06:48:40 2030 GMT
        Subject: C = US, O = SecureTrust, CN = "SecureTrust TWG Secure Email CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                AA:43:F4:C3:6C:40:2A:E2:4A:81:1C:83:A9:DE:CF:B5:E1:1B:B6:CE
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.securetrust.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ACCCAAF77372FFD2BD7BB21861B224EE1DAE8FE640D03A8FDE7518EC9B32508B
    SPKI SHA256: A1746B0C366F34747CE1B5AF41B6D19FE1E77DC1ECCFC86EB3A47A6530D06AA1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.securetrust.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.securetrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z Code Signing CA RSA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z Code Signing CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 196A0E18A1EBE03E11D1EBBF5B155D5C
- SHA-256: 83DD76F92A6AB49C0A1D738A78C797C28E9A0503509B0B3F058A5D0A30CF1AEC
- SPKI SHA-256: 07CD2E3652ED6495CDF73D002DC0B1472D46117AF436947E1624AEE6E6760E98
- Validity: 2019-08-22 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-codeSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:6a:0e:18:a1:eb:e0:3e:11:d1:eb:bf:5b:15:5d:5c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Aug 22 17:59:47 2019 GMT
            Not After : Aug 19 17:59:47 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z Code Signing CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                FD:FE:E9:A2:DA:92:C0:D1:54:C8:39:00:25:27:E5:84:CE:61:18:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 83DD76F92A6AB49C0A1D738A78C797C28E9A0503509B0B3F058A5D0A30CF1AEC
    SPKI SHA256: 07CD2E3652ED6495CDF73D002DC0B1472D46117AF436947E1624AEE6E6760E98
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z Document Signing CA RSA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z Document Signing CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 605B97FC49161B854CD2EE916F57496D
- SHA-256: 861DAB27BEF0D2D04CDFA288B2345ED5EAE1A979424765B8BDA5EC321193238A
- SPKI SHA-256: 25017024683CCB5611BAF8C347F5D2ABC91785B17E2D6FF2CC51D50568ACE310
- Validity: 2019-08-22 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-docSigning-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:5b:97:fc:49:16:1b:85:4c:d2:ee:91:6f:57:49:6d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Aug 22 18:01:50 2019 GMT
            Not After : Aug 19 18:01:50 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z Document Signing CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                70:70:7C:98:F8:BA:33:CA:6F:E9:6B:AD:DA:C0:B6:19:7B:DC:72:7A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 861DAB27BEF0D2D04CDFA288B2345ED5EAE1A979424765B8BDA5EC321193238A
    SPKI SHA256: 25017024683CCB5611BAF8C347F5D2ABC91785B17E2D6FF2CC51D50568ACE310
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z EV TLS CA ECC R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z EV TLS CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 3CB4D69647CA26DD634081358195013F
- SHA-256: 9037D9090A63664CEE444BE8633109765C90A9E0E0032A36C437E3BABBB94EDE
- SPKI SHA-256: 4E09BBE0AF046EE08128292DB9D1BD0BF5173B98ABC072FCA8D62EC5D26FD41F
- Validity: 2019-08-22 to 2029-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:b4:d6:96:47:ca:26:dd:63:40:81:35:81:95:01:3f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Aug 22 17:50:59 2019 GMT
            Not After : Aug 19 17:50:59 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z EV TLS CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Subject Key Identifier:
                7A:60:8B:A4:69:06:77:1E:B2:CA:4E:F7:93:1B:99:69:91:D7:C5:84
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9037D9090A63664CEE444BE8633109765C90A9E0E0032A36C437E3BABBB94EDE
    SPKI SHA256: 4E09BBE0AF046EE08128292DB9D1BD0BF5173B98ABC072FCA8D62EC5D26FD41F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z EV TLS CA RSA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z EV TLS CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 287A49A619836714483C164647FF3608
- SHA-256: FC55270FECC7CD8B139E34CB0E896606B2B03BBF5848930A50A251343A36D10C
- SPKI SHA-256: 4C941DE29FCC6F880471773F7DAAB220A0F4D89549B8F7119833FA796AD88F85
- Validity: 2019-08-22 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-EV-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:7a:49:a6:19:83:67:14:48:3c:16:46:47:ff:36:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Aug 22 17:52:55 2019 GMT
            Not After : Aug 19 17:52:55 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z EV TLS CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                7B:2F:71:3D:F5:D1:34:E4:EF:1B:C1:74:29:CF:48:F1:34:F2:73:D9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FC55270FECC7CD8B139E34CB0E896606B2B03BBF5848930A50A251343A36D10C
    SPKI SHA256: 4C941DE29FCC6F880471773F7DAAB220A0F4D89549B8F7119833FA796AD88F85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z SMIME CA RSA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z SMIME CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 5AF6736540F1FC69F81D81E96565769B
- SHA-256: 3160058E72B0587E753ACB14CB37D7F8F672D7BC53549F67D78F39CAB7861824
- SPKI SHA-256: 31DA060EB85C0A7F0C4F0486DE482B7E08F56F61BEBB6C0D9D0A5863A0DAFD12
- Validity: 2019-08-22 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-SMIME-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:f6:73:65:40:f1:fc:69:f8:1d:81:e9:65:65:76:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Aug 22 17:54:38 2019 GMT
            Not After : Aug 19 17:54:38 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z SMIME CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                F8:81:2E:DF:9B:D0:34:81:3F:25:1B:0B:1B:A1:8C:9B:2A:61:63:F6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3160058E72B0587E753ACB14CB37D7F8F672D7BC53549F67D78F39CAB7861824
    SPKI SHA256: 31DA060EB85C0A7F0C4F0486DE482B7E08F56F61BEBB6C0D9D0A5863A0DAFD12
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z TLS CA ECC R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z TLS CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 3DC007E7A5CD4F1B82BF70CBEF1811E2
- SHA-256: 7A7DADE08568FD3BFF2453E69B7A84D5BF4173B4BF58CD0643FF060C35F9165D
- SPKI SHA-256: 4C2D6190C8A485B35B593ED38D40E71DDB78864173E1D63B50BC3017CFA57F72
- Validity: 2019-08-22 to 2029-08-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-SSL-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:c0:07:e7:a5:cd:4f:1b:82:bf:70:cb:ef:18:11:e2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Aug 22 17:56:10 2019 GMT
            Not After : Aug 19 17:56:10 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z TLS CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                BF:22:01:6D:E2:B6:B0:BD:CE:5E:96:E6:72:FE:26:00:8F:12:31:FB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7A7DADE08568FD3BFF2453E69B7A84D5BF4173B4BF58CD0643FF060C35F9165D
    SPKI SHA256: 4C2D6190C8A485B35B593ED38D40E71DDB78864173E1D63B50BC3017CFA57F72
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL X Y & Z TLS CA RSA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=SSL X Y & Z Corp., commonName=SSL X Y & Z TLS CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 29E282780199DA757A1B37E073467B35
- SHA-256: 70C7E68119DFAD128A88E1D7AF8E74D5A19E2B19A1F5E8F008A9CF50F44F2DBB
- SPKI SHA-256: 4784FB1D7EA9299A7DAFB386AFA37209871D52C107FDA69DE997EDFCB32FC9FD
- Validity: 2019-08-22 to 2029-08-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLXYZ-Intermediate-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:e2:82:78:01:99:da:75:7a:1b:37:e0:73:46:7b:35
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Aug 22 17:58:02 2019 GMT
            Not After : Aug 19 17:58:02 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = SSL X Y & Z Corp., CN = SSL X Y & Z TLS CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                95:52:B7:58:74:BA:0F:88:17:AC:BD:5F:B8:21:19:6B:B2:F2:42:1F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 70C7E68119DFAD128A88E1D7AF8E74D5A19E2B19A1F5E8F008A9CF50F44F2DBB
    SPKI SHA256: 4784FB1D7EA9299A7DAFB386AFA37209871D52C107FDA69DE997EDFCB32FC9FD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Client Authentication Issuing ECC CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Issuing ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022
- Serial: 6A4287D6BECF25619DB812AD64F2A3F9
- SHA-256: 8ABAE17514BF7B01F236B84EB4A78DA2CD438D92C78E4E02B761834189F571CD
- SPKI SHA-256: 9E5F095C0F73D38A7EBD47362C2452F571A1348F996E745370335E412637E6CD
- Validity: 2026-02-24 to 2036-02-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-I-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:42:87:d6:be:cf:25:61:9d:b8:12:ad:64:f2:a3:f9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client ECC Root CA 2022
        Validity
            Not Before: Feb 24 15:03:38 2026 GMT
            Not After : Feb 22 15:03:37 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Client Authentication Issuing ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B7:FE:2D:62:C5:81:53:CD:52:1A:2F:5D:60:A0:C3:5D:FB:B2:1C:1C
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                05:05:2F:A6:2C:4D:BD:D5:6D:77:11:5B:D8:0A:A4:3A:F2:65:BF:30
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8ABAE17514BF7B01F236B84EB4A78DA2CD438D92C78E4E02B761834189F571CD
    SPKI SHA256: 9E5F095C0F73D38A7EBD47362C2452F571A1348F996E745370335E412637E6CD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Issuing ECC CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Issuing ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 68A2110D54F4F78FB51F3CDF419104E3
- SHA-256: E37FBC7CC5BDDB3D2DB27F6F71DB6C78A64974A718F7CDB59406B24F1977335A
- SPKI SHA-256: 8C9C4F10EF47688A34A8FD5E3A169FCFA437D0B32FCE8CCB410A85488E18A8BF
- Validity: 2022-03-21 to 2032-03-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:a2:11:0d:54:f4:f7:8f:b5:1f:3c:df:41:91:04:e3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar 21 20:10:26 2022 GMT
            Not After : Mar 18 20:10:25 2032 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Client Authentication Issuing ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                3E:81:23:01:24:7A:67:DE:E4:D5:E7:3D:95:40:53:54:BD:EC:25:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E37FBC7CC5BDDB3D2DB27F6F71DB6C78A64974A718F7CDB59406B24F1977335A
    SPKI SHA256: 8C9C4F10EF47688A34A8FD5E3A169FCFA437D0B32FCE8CCB410A85488E18A8BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022
- Serial: 0AD3841E6100C78D6EBAE2497CFE6513
- SHA-256: 0AD0AB17D3D5B88CA33951B48759B817D2ADFA741C02F494C26F2629F256C1C5
- SPKI SHA-256: 2A1E6A905E44AFF99F0649774D12253571497FB1312067A15A27BB30C55D46E4
- Validity: 2026-02-24 to 2036-02-22
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:d3:84:1e:61:00:c7:8d:6e:ba:e2:49:7c:fe:65:13
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client RSA Root CA 2022
        Validity
            Not Before: Feb 24 15:05:41 2026 GMT
            Not After : Feb 22 15:05:40 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Client Authentication Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F0:38:42:94:34:A9:3C:00:7F:52:EE:39:A5:F7:4B:0D:BC:6A:7D:23
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                E5:5D:46:F0:80:AA:DF:A6:50:A1:17:3E:D2:A8:09:00:0A:AA:CB:26
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0AD0AB17D3D5B88CA33951B48759B817D2ADFA741C02F494C26F2629F256C1C5
    SPKI SHA256: 2A1E6A905E44AFF99F0649774D12253571497FB1312067A15A27BB30C55D46E4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Issuing RSA CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Issuing RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 0675724B3AE4FEAF3806582A3080B7F8
- SHA-256: 816CB0782117EEB32535CFFA12A7D40B60BD3B2258B79263F72D3D9F4B65C22C
- SPKI SHA-256: F82D1CCE4657DD310B7706FB8C0C3A56CFCD2A13F825772123370C89935FAF5E
- Validity: 2022-03-21 to 2032-03-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:75:72:4b:3a:e4:fe:af:38:06:58:2a:30:80:b7:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 21 20:11:01 2022 GMT
            Not After : Mar 18 20:11:00 2032 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Client Authentication Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                9C:77:E1:A4:BC:5D:A8:A1:81:68:38:B9:87:2A:97:77:24:7C:74:B3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 816CB0782117EEB32535CFFA12A7D40B60BD3B2258B79263F72D3D9F4B65C22C
    SPKI SHA256: F82D1CCE4657DD310B7706FB8C0C3A56CFCD2A13F825772123370C89935FAF5E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Transit ECC CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Transit ECC CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022
- Serial: 73C0C72DE3C3C12C17BF6184FCD430C6
- SHA-256: 3AAB88125386A56057825F24FF36B6EEEE4DCA54F0C79372C25516F846BAE8FA
- SPKI SHA-256: 7201B2DA275F4BF4DE4D35062A082656EF49623AA215ABEB3148BE7943991486
- Validity: 2026-02-24 to 2041-02-20
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-T-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:c0:c7:2d:e3:c3:c1:2c:17:bf:61:84:fc:d4:30:c6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client ECC Root CA 2022
        Validity
            Not Before: Feb 24 15:06:11 2026 GMT
            Not After : Feb 20 15:06:10 2041 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Client Authentication Transit ECC CA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                B7:FE:2D:62:C5:81:53:CD:52:1A:2F:5D:60:A0:C3:5D:FB:B2:1C:1C
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                6F:60:D8:A9:60:0A:1F:B9:95:1D:46:DB:31:15:01:73:BB:36:31:6F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3AAB88125386A56057825F24FF36B6EEEE4DCA54F0C79372C25516F846BAE8FA
    SPKI SHA256: 7201B2DA275F4BF4DE4D35062A082656EF49623AA215ABEB3148BE7943991486
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Transit ECC CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 504FC28AF1896136712B8B796A82DA8F
- SHA-256: 57DBBE6283F762C1EE40525F5872180230FDF489D0FBC93F7BA39DAAF4F6B3B7
- SPKI SHA-256: F28BB61762E77B92A68EAA4C50555080E42E751D68AAA3F6CD2FEECC28837330
- Validity: 2022-03-21 to 2037-03-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:4f:c2:8a:f1:89:61:36:71:2b:8b:79:6a:82:da:8f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar 21 20:11:22 2022 GMT
            Not After : Mar 17 20:11:21 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Client Authentication Transit ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                B2:D4:E9:AF:27:FA:6F:D1:83:88:C6:AB:6E:3C:94:FF:C3:B8:0C:DE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 57DBBE6283F762C1EE40525F5872180230FDF489D0FBC93F7BA39DAAF4F6B3B7
    SPKI SHA256: F28BB61762E77B92A68EAA4C50555080E42E751D68AAA3F6CD2FEECC28837330
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Transit RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client Authentication Transit RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022
- Serial: 712712AFCC7D391BA693B25236F65571
- SHA-256: AE03BD59362E3AD9F00D329F22AE191A5D773814614E1C53D498F6AEDCD97E96
- SPKI SHA-256: 765135058D6C097FCB24A48C20D361EDED7A20BF0AEAE390F0B17DF3205E515A
- Validity: 2026-02-24 to 2041-02-20
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-T-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:27:12:af:cc:7d:39:1b:a6:93:b2:52:36:f6:55:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client RSA Root CA 2022
        Validity
            Not Before: Feb 24 15:06:40 2026 GMT
            Not After : Feb 20 15:06:39 2041 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Client Authentication Transit RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F0:38:42:94:34:A9:3C:00:7F:52:EE:39:A5:F7:4B:0D:BC:6A:7D:23
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                78:EB:ED:61:FD:E8:AD:F7:C3:0C:46:DC:C5:2B:B3:30:D1:58:17:1C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AE03BD59362E3AD9F00D329F22AE191A5D773814614E1C53D498F6AEDCD97E96
    SPKI SHA256: 765135058D6C097FCB24A48C20D361EDED7A20BF0AEAE390F0B17DF3205E515A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Authentication Transit RSA CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Client Authentication Transit RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 6F4C0EE9E4CB697DA1011649033E5C3B
- SHA-256: 0546601756A3F862E4DE2D1EDA3DB90EF271CAEF8D7B28A5FEE32D947269F137
- SPKI SHA-256: AB739E405BF020BB19C5EB7D4DCF07376BA46C52FDA89EA873A96878897FE4FB
- Validity: 2022-03-21 to 2037-03-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-clientAuth-T-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:4c:0e:e9:e4:cb:69:7d:a1:01:16:49:03:3e:5c:3b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 21 20:11:40 2022 GMT
            Not After : Mar 17 20:11:39 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Client Authentication Transit RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                30:09:7D:12:4F:0C:0F:DE:61:8F:A8:4A:E1:6A:06:FE:AE:33:D0:5F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0546601756A3F862E4DE2D1EDA3DB90EF271CAEF8D7B28A5FEE32D947269F137
    SPKI SHA256: AB739E405BF020BB19C5EB7D4DCF07376BA46C52FDA89EA873A96878897FE4FB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Client Certificate Enterprise Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Enterprise Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 38F1A5174E21C826C952D7BF9DDF2FF2
- SHA-256: 17CD6504B275A6634EE0016EFFE53B26BFFCCA289C7DED4A1C8F4353CD05B09C
- SPKI SHA-256: 87DB2A913365BDB1C473F4827B4F4D72E2ADD253222352E856397FDBBA5F4B5C
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:f1:a5:17:4e:21:c8:26:c9:52:d7:bf:9d:df:2f:f2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:28:55 2019 GMT
            Not After : Mar 22 17:28:55 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Enterprise Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                17:B6:0F:04:09:52:2A:F0:26:6F:F3:62:70:22:10:DD:B5:2B:F1:B2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 17CD6504B275A6634EE0016EFFE53B26BFFCCA289C7DED4A1C8F4353CD05B09C
    SPKI SHA256: 87DB2A913365BDB1C473F4827B4F4D72E2ADD253222352E856397FDBBA5F4B5C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Client Certificate Intermediate CA ECC R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 096F1896736E2614
- SHA-256: 8EE3E21EF64E24E574964613D8DCD782D10A1CF45B93EA5F7D5111A5DABAF303
- SPKI SHA-256: FB45032ABF8680A59303859F0D4D616A548917A04D28C6A5B841702C5B250596
- Validity: 2018-12-17 to 2033-12-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-clientCert-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 679789103216993812 (0x96f1896736e2614)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec 17 19:45:51 2018 GMT
            Not After : Dec 13 19:45:51 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Intermediate CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                54:D3:D8:62:4A:8A:25:9B:85:77:22:55:B6:9C:A1:21:F6:75:AD:D4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 8EE3E21EF64E24E574964613D8DCD782D10A1CF45B93EA5F7D5111A5DABAF303
    SPKI SHA256: FB45032ABF8680A59303859F0D4D616A548917A04D28C6A5B841702C5B250596
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Client Certificate Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 27AB85FE033109F1FDB5032D577D2038
- SHA-256: EAD0C5077C99F8FA40CC556DBC2EACA41F54E9D99EBD468956AEA8BEC5AAF76A
- SPKI SHA-256: 6747005C26F0D71A38B15A5E12C74F0E8887765B851FBC04B5CCEDF5774AED27
- Validity: 2019-03-07 to 2034-03-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-clientCert-ECC-384-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:ab:85:fe:03:31:09:f1:fd:b5:03:2d:57:7d:20:38
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:34:04 2019 GMT
            Not After : Mar  3 19:34:04 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                77:28:35:14:52:65:55:0F:D8:21:67:9F:A6:A2:4A:35:91:81:25:54
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EAD0C5077C99F8FA40CC556DBC2EACA41F54E9D99EBD468956AEA8BEC5AAF76A
    SPKI SHA256: 6747005C26F0D71A38B15A5E12C74F0E8887765B851FBC04B5CCEDF5774AED27
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Client Certificate Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 6280F029C406DEB8
- SHA-256: 9B9C55D586F15F4FF0A12E3E87AA2AE5F6C0C218857E0DB4CC4A1BA74E493F54
- SPKI SHA-256: 61E7948DDF7849C749F22DBE86927096FEAC5801DB721406CFE4DCD8E3C76136
- Validity: 2018-12-17 to 2033-12-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-clientCert-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7097937074909011640 (0x6280f029c406deb8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec 17 19:44:04 2018 GMT
            Not After : Dec 13 19:44:04 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                BC:76:2D:83:49:85:98:D3:41:A2:56:D6:DB:97:43:79:90:AE:2A:17
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9B9C55D586F15F4FF0A12E3E87AA2AE5F6C0C218857E0DB4CC4A1BA74E493F54
    SPKI SHA256: 61E7948DDF7849C749F22DBE86927096FEAC5801DB721406CFE4DCD8E3C76136
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Client Certificate Intermediate CA RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Intermediate CA RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 079FDC8940488AF1D96FD2740A645566
- SHA-256: B6E44A69342D84363AB12182F2D2B888501B063A76BEB00350E38DDC74715034
- SPKI SHA-256: 8B4F2383440142610CF89A89810C77DB77C344F446755A2A2A9D47EF2CFBF486
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-clientCert-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:9f:dc:89:40:48:8a:f1:d9:6f:d2:74:0a:64:55:66
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:41:06 2019 GMT
            Not After : Mar 22 17:41:06 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Intermediate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                66:8F:A6:BC:B7:93:2C:9D:F9:BA:49:E5:4F:DC:EA:90:50:11:6A:9D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B6E44A69342D84363AB12182F2D2B888501B063A76BEB00350E38DDC74715034
    SPKI SHA256: 8B4F2383440142610CF89A89810C77DB77C344F446755A2A2A9D47EF2CFBF486
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Code Signing Enterprise Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Enterprise Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 5B7F543825E41AA12ADE21439CDFE66F
- SHA-256: 11EADC5379B152C1A90D1DBE00722C53165B320031F5BA469ADF5902FDB1FA45
- SPKI SHA-256: F872888FDB4B214AA0123D18E66E6D3606382D619A5D660A67CE81BDC1336E53
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:7f:54:38:25:e4:1a:a1:2a:de:21:43:9c:df:e6:6f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:33:21 2019 GMT
            Not After : Mar 22 17:33:21 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Enterprise Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                44:FA:2E:E6:80:21:A4:46:97:0E:6A:E8:33:BC:53:11:66:4D:A9:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11EADC5379B152C1A90D1DBE00722C53165B320031F5BA469ADF5902FDB1FA45
    SPKI SHA256: F872888FDB4B214AA0123D18E66E6D3606382D619A5D660A67CE81BDC1336E53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Code Signing Intermediate CA ECC R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Intermediate CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 6207F27DE09F3D35
- SHA-256: F31EEB5480F01DEF0390238072AC040B72D86D1BE2F97B8EDCE7667086A6B4B2
- SPKI SHA-256: 827436A4641B6E32532A93B3A45C5BD6893077AC1ED174EF6C1E84DB675044A8
- Validity: 2018-12-17 to 2033-12-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-codeSigning-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7063881163007278389 (0x6207f27de09f3d35)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec 17 20:28:13 2018 GMT
            Not After : Dec 13 20:28:13 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Intermediate CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                A5:8C:E2:86:45:BD:C9:52:76:57:9E:E7:AD:78:A3:3C:B0:9D:FD:C2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F31EEB5480F01DEF0390238072AC040B72D86D1BE2F97B8EDCE7667086A6B4B2
    SPKI SHA256: 827436A4641B6E32532A93B3A45C5BD6893077AC1ED174EF6C1E84DB675044A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Code Signing Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 1CCF9D67CDE219FF12D99AFF3682E5A7
- SHA-256: F74E750A5DCF00D5E85168A60C963EC2AEBDCA3ADB0291D3281D8F521BA6A3BD
- SPKI SHA-256: 8B863184D2AD5B1BA98C1F9463E0FD7EF5BF3D61446A0ABE348A838C5062330C
- Validity: 2019-03-07 to 2034-03-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-codeSigning-ECC-384-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:35:47 2019 GMT
            Not After : Mar  3 19:35:47 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                32:78:B1:0E:90:DB:46:CF:1A:CF:B6:63:11:6D:FE:30:E7:67:54:30
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F74E750A5DCF00D5E85168A60C963EC2AEBDCA3ADB0291D3281D8F521BA6A3BD
    SPKI SHA256: 8B863184D2AD5B1BA98C1F9463E0FD7EF5BF3D61446A0ABE348A838C5062330C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Code Signing Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Code Signing Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 643351D3C7389F08
- SHA-256: 8F6D67C6F8FC5159A8E77A17099B74B9C96C0A7E1BC7D8EB86A08E0DC7681598
- SPKI SHA-256: B6EA98F623E7DB30B6674C4F9F373B8A514AE986325CABF6ADF2F4C70AED8BB2
- Validity: 2016-06-24 to 2031-06-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7220204597627363080 (0x643351d3c7389f08)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Jun 24 20:44:30 2016 GMT
            Not After : Jun 24 20:44:30 2031 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Code Signing Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                54:C2:FE:10:95:00:93:CD:6A:F5:E7:C0:D7:D9:B2:4B:B8:8F:0C:E3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F6D67C6F8FC5159A8E77A17099B74B9C96C0A7E1BC7D8EB86A08E0DC7681598
    SPKI SHA256: B6EA98F623E7DB30B6674C4F9F373B8A514AE986325CABF6ADF2F4C70AED8BB2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### SSL.com Code Signing Transit ECC CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Code Signing Transit ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 303790C786E6A6E78CBCA730AAC27104
- SHA-256: 704F0FD395EA2FF06E6769A69627290453985A4FB5D923DA255D27D5739CB464
- SPKI SHA-256: C60636A630FB4FEC0AFA2DC613D7746BB9186A778293EB85A54FF9CC7FDF5DEC
- Validity: 2022-02-28 to 2037-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-codeSigning-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:37:90:c7:86:e6:a6:e7:8c:bc:a7:30:aa:c2:71:04
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 28 21:28:18 2022 GMT
            Not After : Feb 24 21:28:17 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Code Signing Transit ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                90:14:AB:6D:1C:27:C6:8D:10:54:34:72:1E:54:FA:5D:C7:B9:32:2C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 704F0FD395EA2FF06E6769A69627290453985A4FB5D923DA255D27D5739CB464
    SPKI SHA256: C60636A630FB4FEC0AFA2DC613D7746BB9186A778293EB85A54FF9CC7FDF5DEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Code Signing Transit ECC CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing Transit ECC CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing ECC Root CA 2022
- Serial: 36F066A7062A84F0145FA32B6DEE65AB
- SHA-256: 88BBDC35134E2FD74CAE724CDB4FDFD82ADD4CAD371EBFFC87752B3469167A28
- SPKI SHA-256: 6BBBBA5CF3B82D8039262FCD8CC55D1DFADE9C257E0FDB43A8A8CD5D1446ADAD
- Validity: 2022-10-21 to 2037-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-CodeSigning-T-ECC-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:f0:66:a7:06:2a:84:f0:14:5f:a3:2b:6d:ee:65:ab
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Code Signing ECC Root CA 2022
        Validity
            Not Before: Oct 21 16:53:12 2022 GMT
            Not After : Oct 17 16:53:11 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Code Signing Transit ECC CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                58:5E:16:C3:2D:B3:E6:EA:A3:49:B3:A5:BE:D6:DE:AE:79:95:6B:8D
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-CodeSigning-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                C6:14:C3:07:C5:8F:B6:80:A4:94:B7:42:35:A9:16:9D:54:1E:5D:72
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 88BBDC35134E2FD74CAE724CDB4FDFD82ADD4CAD371EBFFC87752B3469167A28
    SPKI SHA256: 6BBBBA5CF3B82D8039262FCD8CC55D1DFADE9C257E0FDB43A8A8CD5D1446ADAD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-CodeSigning-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Code Signing Transit RSA CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing Transit RSA CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing RSA Root CA 2022
- Serial: 11131C1B55CA2EC6E498E2DDFDB39C04
- SHA-256: 0D63478BCA93AA705B4323F4780E8EA03E2482D84F5E3F3666A83693C5AA38B7
- SPKI SHA-256: 95CAADC3F3538D900604B7C7932760B60E981C5BD3256BFE9BC1CBC7A3580232
- Validity: 2022-10-21 to 2037-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-CodeSigning-T-RSA-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:13:1c:1b:55:ca:2e:c6:e4:98:e2:dd:fd:b3:9c:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Code Signing RSA Root CA 2022
        Validity
            Not Before: Oct 21 16:53:40 2022 GMT
            Not After : Oct 17 16:53:39 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Code Signing Transit RSA CA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                C7:F6:C8:0B:62:ED:14:0C:A3:17:B6:AA:B9:1E:D1:E0:83:56:A1:5D
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-CodeSigning-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                AB:24:A9:2E:53:D8:98:D5:CB:97:CE:4F:82:57:24:7B:9E:51:EF:12
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0D63478BCA93AA705B4323F4780E8EA03E2482D84F5E3F3666A83693C5AA38B7
    SPKI SHA256: 95CAADC3F3538D900604B7C7932760B60E981C5BD3256BFE9BC1CBC7A3580232
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-CodeSigning-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-CodeSigning-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Document Signing Transit ECC CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 7D5647822A3F02FF09216CE591682C57
- SHA-256: 683ABF185050ED924D58D73493F5452C73DC364611107C436FDC2391643D0D0F
- SPKI SHA-256: BB244F4EE147B1E2B621FD891B479E7E6DA8EC9E2599C6A2FB7A18BB30918A26
- Validity: 2022-03-21 to 2037-03-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:56:47:82:2a:3f:02:ff:09:21:6c:e5:91:68:2c:57
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar 21 20:12:05 2022 GMT
            Not After : Mar 17 20:12:04 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                0B:B1:7B:BF:F3:B8:43:45:DB:10:BE:97:CF:14:43:DE:22:B0:93:F5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 683ABF185050ED924D58D73493F5452C73DC364611107C436FDC2391643D0D0F
    SPKI SHA256: BB244F4EE147B1E2B621FD891B479E7E6DA8EC9E2599C6A2FB7A18BB30918A26
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Document Signing Transit ECC CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit ECC CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing ECC Root CA 2022
- Serial: 2988A93964A28F541F05559837720DBD
- SHA-256: 5C8A484E466F94CB6D49A76053058D243A76D25BC7D763E0319DEDA323037615
- SPKI SHA-256: C761245843C1688F3C313C8BB6F833500CAD976308DE91FC977801B26602B6A4
- Validity: 2022-10-21 to 2037-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-docSigning-T-ECC-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:88:a9:39:64:a2:8f:54:1f:05:55:98:37:72:0d:bd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing ECC Root CA 2022
        Validity
            Not Before: Oct 21 16:57:58 2022 GMT
            Not After : Oct 17 16:57:57 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Document Signing Transit ECC CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                32:FB:D5:9B:CB:6D:9C:FD:81:AE:13:7D:DA:0C:C3:34:F5:3A:4D:35
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-DocumentSigning-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                E3:74:6E:01:A9:0D:16:9A:EE:08:F5:BC:F3:37:DD:BF:CA:43:07:87
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5C8A484E466F94CB6D49A76053058D243A76D25BC7D763E0319DEDA323037615
    SPKI SHA256: C761245843C1688F3C313C8BB6F833500CAD976308DE91FC977801B26602B6A4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-DocumentSigning-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Document Signing Transit RSA CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 09F60032F2F15420ED3030BF29CB7326
- SHA-256: 1A6CD68DD63F3466C0E4808C4D663376D58426301772339823CFB6E5BC075BD3
- SPKI SHA-256: B6840D30A625845CD5A7B9595BEFE0A119921C4A080C13BA925C19553BA1B6D2
- Validity: 2022-03-21 to 2037-03-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            09:f6:00:32:f2:f1:54:20:ed:30:30:bf:29:cb:73:26
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 21 20:12:24 2022 GMT
            Not After : Mar 17 20:12:23 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                C5:7C:D2:40:1E:7F:F8:A6:12:D9:05:B9:52:DB:31:67:64:72:3B:B4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1A6CD68DD63F3466C0E4808C4D663376D58426301772339823CFB6E5BC075BD3
    SPKI SHA256: B6840D30A625845CD5A7B9595BEFE0A119921C4A080C13BA925C19553BA1B6D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Document Signing Transit RSA CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit RSA CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing RSA Root CA 2022
- Serial: 6DD5A729960E97BD350AEE8D84773D1F
- SHA-256: B8F10BF4FCBD60C23D82E4F2DF6CD77DB9978E88013C4E7FC01683F90FB8FC53
- SPKI SHA-256: CC23B6A8C97A2B4C700767509212C0472515A40D0F355D78E5FB0DDD36A7101E
- Validity: 2022-10-21 to 2037-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:d5:a7:29:96:0e:97:bd:35:0a:ee:8d:84:77:3d:1f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing RSA Root CA 2022
        Validity
            Not Before: Oct 21 16:58:35 2022 GMT
            Not After : Oct 17 16:58:34 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com Document Signing Transit RSA CA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                04:C6:1E:79:62:8C:9A:D0:A7:84:B3:7B:77:9B:B1:C0:86:F3:48:1F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-DocumentSigning-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                88:41:20:FC:3F:A5:57:CF:64:86:22:AB:26:37:21:6E:18:FC:6F:B4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B8F10BF4FCBD60C23D82E4F2DF6CD77DB9978E88013C4E7FC01683F90FB8FC53
    SPKI SHA256: CC23B6A8C97A2B4C700767509212C0472515A40D0F355D78E5FB0DDD36A7101E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-DocumentSigning-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-DocumentSigning-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com ECC SSL subCA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com ECC SSL subCA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 60FE918B4A57B201
- SHA-256: B5C418827EA2D33653898EBAE4D53E32417BA315495B3A3A0453799974E0682D
- SPKI SHA-256: A53BB2E26C15AF6E87C06EAE9F4612A00F80597DDFC85C7BC25C1F8D62A077B7
- Validity: 2016-02-12 to 2031-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-SSL-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6989183699159331329 (0x60fe918b4a57b201)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 12 18:53:47 2016 GMT
            Not After : Feb 12 18:53:47 2031 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com ECC SSL subCA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Subject Key Identifier:
                4F:14:D0:90:B6:2D:BD:78:71:91:EB:8C:AA:E6:5E:E2:EE:8B:AC:D8
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: B5C418827EA2D33653898EBAE4D53E32417BA315495B3A3A0453799974E0682D
    SPKI SHA256: A53BB2E26C15AF6E87C06EAE9F4612A00F80597DDFC85C7BC25C1F8D62A077B7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### SSL.com Enterprise Intermediate CA ECC R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 40016D3E7B914F07
- SHA-256: 571DA0D10AC4DD3CD980C34D0B7327D57D25256D4C5F66BBF3CC3D0F789C6EE1
- SPKI SHA-256: 2011AFA69BA5AD55D506ACFD419441D5F116B3353B5FAE81EDF827FD85D36C6D
- Validity: 2018-12-17 to 2033-12-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4612087608532619015 (0x40016d3e7b914f07)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec 17 20:44:50 2018 GMT
            Not After : Dec 13 20:44:50 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Enterprise Intermediate CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                26:EE:C7:7C:3B:13:B7:6C:D4:87:BC:EB:16:10:EE:9F:9D:43:8C:5F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 571DA0D10AC4DD3CD980C34D0B7327D57D25256D4C5F66BBF3CC3D0F789C6EE1
    SPKI SHA256: 2011AFA69BA5AD55D506ACFD419441D5F116B3353B5FAE81EDF827FD85D36C6D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Enterprise Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 7793635F02C11EB5
- SHA-256: 573C54B2121ECB4B6C3BE17EA614C5C43B4D6B7D796EDDFFB1C074BA2443A136
- SPKI SHA-256: A9FF1B7E406F593E530B438B24E0889EFDDFE0D4899D8C05EAED43EFD5C6B69E
- Validity: 2018-12-17 to 2033-12-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-ECC-384-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8616339771809144501 (0x7793635f02c11eb5)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec 17 20:46:51 2018 GMT
            Not After : Dec 13 20:46:51 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Enterprise Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                B0:7C:70:96:5A:EA:94:17:8E:56:C7:67:DC:AC:DF:03:FD:12:3E:39
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 573C54B2121ECB4B6C3BE17EA614C5C43B4D6B7D796EDDFFB1C074BA2443A136
    SPKI SHA256: A9FF1B7E406F593E530B438B24E0889EFDDFE0D4899D8C05EAED43EFD5C6B69E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Enterprise Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 05C2A54D715CF661
- SHA-256: F1A8595E7C670289502FC676C26F1B564E316FC4C0F5D23975557BD7B5330532
- SPKI SHA-256: 1A78742AD34833991481FEEED6BE710206B05888FB3DBA9C681326551C70A53B
- Validity: 2018-12-17 to 2033-12-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 415075867704489569 (0x5c2a54d715cf661)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec 17 20:49:18 2018 GMT
            Not After : Dec 13 20:49:18 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Enterprise Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                66:6B:B9:D4:A0:C0:AE:88:22:35:2F:8F:9A:F3:FE:89:AF:E7:E8:7E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F1A8595E7C670289502FC676C26F1B564E316FC4C0F5D23975557BD7B5330532
    SPKI SHA256: 1A78742AD34833991481FEEED6BE710206B05888FB3DBA9C681326551C70A53B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Enterprise Intermediate CA RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Enterprise Intermediate CA RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 4B85129B9DDC6C85
- SHA-256: A2423AE80C9BA673E948D85EC87908F7836A71134DE5D58C1205D05FE2E7C2F9
- SPKI SHA-256: 32C59B10E25DA22406FA04F44B39D2B6D08536D10FCF3CC6BFB1F53B3C3BEF68
- Validity: 2018-12-17 to 2033-12-13
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5441776184324811909 (0x4b85129b9ddc6c85)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec 17 20:51:32 2018 GMT
            Not After : Dec 13 20:51:32 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Enterprise Intermediate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                28:18:91:0A:CB:FE:2C:5A:C3:99:D9:9A:22:32:A1:E6:6E:66:B3:09
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A2423AE80C9BA673E948D85EC87908F7836A71134DE5D58C1205D05FE2E7C2F9
    SPKI SHA256: 32C59B10E25DA22406FA04F44B39D2B6D08536D10FCF3CC6BFB1F53B3C3BEF68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Code Signing Intermediate CA ECC R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 2956D026CB55866A
- SHA-256: D013A18CC990ED392783A24C581F6628848936B6F5019BEE8C6207CEF191A0A1
- SPKI SHA-256: DAADA1F5FBED15141A4ADA5118F3AA21A7696F3C35E3467851B6C646DE68742D
- Validity: 2018-12-17 to 2033-12-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-codeSigning-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2978797068590876266 (0x2956d026cb55866a)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Dec 17 20:29:40 2018 GMT
            Not After : Dec 13 20:29:40 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Code Signing Intermediate CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Subject Key Identifier:
                95:2A:6B:CB:48:E9:49:6A:BF:C1:CE:DA:F4:92:00:71:F6:37:93:96
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: D013A18CC990ED392783A24C581F6628848936B6F5019BEE8C6207CEF191A0A1
    SPKI SHA256: DAADA1F5FBED15141A4ADA5118F3AA21A7696F3C35E3467851B6C646DE68742D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Code Signing Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 6EDD4F25E7317D3981573134CFC1DCA0
- SHA-256: 8CB32482CDAF38DD68E322AB9B4434E773910F33B2F56F8022D5156208465417
- SPKI SHA-256: C1E57AC08DA862D1539836DECD31EAF0C0188BEE1A2675729043FAFA2C5671E0
- Validity: 2019-03-07 to 2034-03-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-codeSigning-ECC-384-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:dd:4f:25:e7:31:7d:39:81:57:31:34:cf:c1:dc:a0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:37:45 2019 GMT
            Not After : Mar  3 19:37:45 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Code Signing Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Subject Key Identifier:
                01:89:94:B9:FE:B4:33:5D:F0:F1:FA:85:F9:24:46:84:A3:57:69:5E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8CB32482CDAF38DD68E322AB9B4434E773910F33B2F56F8022D5156208465417
    SPKI SHA256: C1E57AC08DA862D1539836DECD31EAF0C0188BEE1A2675729043FAFA2C5671E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Code Signing Intermediate CA RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 3BA74D76AD86E78E
- SHA-256: D8D382E37D2F93811AA3D940EEF4C6EEA47BB3BA50271A8BF2E8C24CDD393C56
- SPKI SHA-256: 17D856D24D72148E735DE78B15D00F4EC9BEF8CCBB8664FE5A9D3D2B098AD087
- Validity: 2017-04-06 to 2032-04-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4298489541461206926 (0x3ba74d76ad86e78e)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Apr  6 17:04:50 2017 GMT
            Not After : Apr  6 17:04:50 2032 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Code Signing Intermediate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/certs/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Name Constraints:
                Excluded:
                  DNS:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                6D:33:FF:2D:9A:6F:C6:12:4F:5A:51:76:5C:D2:1F:02:B0:DC:D2:7C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D8D382E37D2F93811AA3D940EEF4C6EEA47BB3BA50271A8BF2E8C24CDD393C56
    SPKI SHA256: 17D856D24D72148E735DE78B15D00F4EC9BEF8CCBB8664FE5A9D3D2B098AD087
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/certs/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Code Signing Intermediate CA RSA R3

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Intermediate CA RSA R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 424B6A53CEC766141C2A63B1A51C4104
- SHA-256: E98DDCC0D158876836CD4B6AD826C44BF0A59A363896CE266C9F0E6CEDC040BC
- SPKI SHA-256: 0343EF982ECC0F0312B691B600C3930464701528F8CDCCC76AFC43498B4CAD45
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Mar 26 17:44:23 2019 GMT
            Not After : Mar 22 17:44:23 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Code Signing Intermediate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                36:BD:49:FF:31:2C:EB:AF:6A:40:FE:99:C0:16:ED:BA:FC:48:DD:5F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E98DDCC0D158876836CD4B6AD826C44BF0A59A363896CE266C9F0E6CEDC040BC
    SPKI SHA256: 0343EF982ECC0F0312B691B600C3930464701528F8CDCCC76AFC43498B4CAD45
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Code Signing Transit ECC CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Transit ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 08C85953A3302B7131455F5BBE5F3BB2
- SHA-256: 7451863C68B08CDA11BEF0AD6D8F5B796D654E2018C1364D7360F1BB42B8A91A
- SPKI SHA-256: 2F6E17E11177A85B7DE8A494DCFCF137B2BB1469A0975F299D9EF7D2097BA763
- Validity: 2022-02-28 to 2037-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVcodeSigning-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:c8:59:53:a3:30:2b:71:31:45:5f:5b:be:5f:3b:b2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Feb 28 21:28:47 2022 GMT
            Not After : Feb 24 21:28:46 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com EV Code Signing Transit ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                F1:68:FF:96:F7:BE:5F:41:A6:9F:D6:DE:18:43:DE:36:2A:3E:7C:50
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7451863C68B08CDA11BEF0AD6D8F5B796D654E2018C1364D7360F1BB42B8A91A
    SPKI SHA256: 2F6E17E11177A85B7DE8A494DCFCF137B2BB1469A0975F299D9EF7D2097BA763
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com EV Code Signing Transit RSA CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com EV Code Signing Transit RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 5981A26DF43689B55E040A76EA532933
- SHA-256: 05E038D0EE8EBB28D52C188469676F1B22F4DF79EB40D9BDC20BCD017782EA28
- SPKI SHA-256: 681A1BC986B1597BD7F0C12363AB3FEB26DECC786D6842F1F0C95C4D812BCBD9
- Validity: 2022-02-28 to 2037-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVcodeSigning-T-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:81:a2:6d:f4:36:89:b5:5e:04:0a:76:ea:53:29:33
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb 28 21:29:22 2022 GMT
            Not After : Feb 24 21:29:21 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com EV Code Signing Transit RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                2E:B1:D5:1A:F6:55:BD:E1:E1:E0:6B:17:83:05:50:96:18:DD:2D:95
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 05E038D0EE8EBB28D52C188469676F1B22F4DF79EB40D9BDC20BCD017782EA28
    SPKI SHA256: 681A1BC986B1597BD7F0C12363AB3FEB26DECC786D6842F1F0C95C4D812BCBD9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com EV ECC SSL subCA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV ECC SSL subCA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 388E0EAB0DD6DC5D
- SHA-256: 31BB2C2E5BAD9F1E21AAAFE04F0E6D97DB67A231975F3AA7D83568E26D7B326D
- SPKI SHA-256: AA87C07D8400A90F92896019C34BFBD085536E64061F5520A64E51D1A6AC912E
- Validity: 2016-02-12 to 2031-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-SSL-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4075210840651258973 (0x388e0eab0dd6dc5d)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Feb 12 19:27:54 2016 GMT
            Not After : Feb 12 19:27:54 2031 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV ECC SSL subCA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Subject Key Identifier:
                11:22:C9:73:F1:38:3B:5D:94:7E:6A:0A:0B:04:35:F7:99:14:52:41
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 31BB2C2E5BAD9F1E21AAAFE04F0E6D97DB67A231975F3AA7D83568E26D7B326D
    SPKI SHA256: AA87C07D8400A90F92896019C34BFBD085536E64061F5520A64E51D1A6AC912E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### SSL.com EV Enterprise Intermediate CA ECC R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Enterprise Intermediate CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 62BE005AD106F7A9
- SHA-256: C65CC16BC32727388D7B190A04C7E5269D575F4CDCCB4E724A863690F6F834C9
- SPKI SHA-256: 0356DB26307F2BCA9537042F9141E26170FB54F5ED8B5467B8EDEF25765917F3
- Validity: 2019-01-16 to 2034-01-12
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 7115124851345913769 (0x62be005ad106f7a9)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Jan 16 20:39:35 2019 GMT
            Not After : Jan 12 20:39:35 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Enterprise Intermediate CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Subject Key Identifier:
                01:93:22:11:45:EC:F2:E1:07:9A:42:FB:4E:65:FF:67:96:6A:C6:DD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: C65CC16BC32727388D7B190A04C7E5269D575F4CDCCB4E724A863690F6F834C9
    SPKI SHA256: 0356DB26307F2BCA9537042F9141E26170FB54F5ED8B5467B8EDEF25765917F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Enterprise Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Enterprise Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 0CEE08F3E87A0C9A
- SHA-256: A1725CC3E2FE78AC09D73FCFC5F00104136E1841262D056C214778FEAE9760D3
- SPKI SHA-256: 68897BF383723F09DE663559BA2E60504E773DA59C8717D7E0FEF16C77D6CADF
- Validity: 2019-01-16 to 2034-01-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 931692016582659226 (0xcee08f3e87a0c9a)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Jan 16 20:43:04 2019 GMT
            Not After : Jan 12 20:43:04 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Enterprise Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                CE:FB:DD:92:14:30:4A:46:CB:10:D9:83:54:09:44:19:51:34:F3:AC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A1725CC3E2FE78AC09D73FCFC5F00104136E1841262D056C214778FEAE9760D3
    SPKI SHA256: 68897BF383723F09DE663559BA2E60504E773DA59C8717D7E0FEF16C77D6CADF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07EE24A9BF6E213D980473681EC19ECD062550
- SHA-256: 10B5AAE6A5E9B787D6E0CDAF39A296B64084ABBCFD4A497357BA37EACC1751B5
- SPKI SHA-256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
- Validity: 2026-01-15 to 2034-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:bf:6e:21:3d:98:04:73:68:1e:c1:9e:cd:06:25:50
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 10B5AAE6A5E9B787D6E0CDAF39A296B64084ABBCFD4A497357BA37EACC1751B5
    SPKI SHA256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EE24A9C203A9F718E7D080B3D11FBC645649
- SHA-256: 64BEB202D4BFBDDC7D0D8E7AB1CD3C25FB17F4AC031B83B75EE1BF53DB7D4341
- SPKI SHA-256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
- Validity: 2026-01-15 to 2029-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:c2:03:a9:f7:18:e7:d0:80:b3:d1:1f:bc:64:56:49
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2029 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 64BEB202D4BFBDDC7D0D8E7AB1CD3C25FB17F4AC031B83B75EE1BF53DB7D4341
    SPKI SHA256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 7FA32B28B1C9AB6C
- SHA-256: 60EF412EABE7C3FC6399EED1B633B777747515B29D721B963DD258BC498AB292
- SPKI SHA-256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
- Validity: 2019-02-14 to 2027-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9197242317802154860 (0x7fa32b28b1c9ab6c)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Feb 14 18:08:58 2019 GMT
            Not After : Feb 12 18:08:58 2027 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 60EF412EABE7C3FC6399EED1B633B777747515B29D721B963DD258BC498AB292
    SPKI SHA256: 348767CDAD3BDD28B2B8DD5351AEC30C68CEC5CD69D276DF3827DBC4F5806464
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### SSL.com EV Root Certification Authority RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EB4265C1F568F4CA532F15DBC0E9D339E367
- SHA-256: B8D068DC6C66079A75669E55B0EA3E66FEF104739471EAFC3D167A68197234F6
- SPKI SHA-256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
- Validity: 2025-12-17 to 2029-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:eb:42:65:c1:f5:68:f4:ca:53:2f:15:db:c0:e9:d3:39:e3:67
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Dec 17 11:19:34 2025 GMT
            Not After : Dec 30 17:19:34 2029 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B8D068DC6C66079A75669E55B0EA3E66FEF104739471EAFC3D167A68197234F6
    SPKI SHA256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Root Certification Authority RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07EE24A9BE2CE41F278CDFB03E634679B92EFD
- SHA-256: 856E1977F4A860E916356E9741EB5840D6CA42EF312A0BE26268784AFEAC462D
- SPKI SHA-256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
- Validity: 2026-01-15 to 2034-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:be:2c:e4:1f:27:8c:df:b0:3e:63:46:79:b9:2e:fd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 856E1977F4A860E916356E9741EB5840D6CA42EF312A0BE26268784AFEAC462D
    SPKI SHA256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Root Certification Authority RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 4EF232176D9BEA14
- SHA-256: 89EFEB25096BA4CCD40AF4FB8756F0A4843995974822020914C4E859D932B7F3
- SPKI SHA-256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
- Validity: 2017-04-06 to 2042-04-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5688664355526928916 (0x4ef232176d9bea14)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Apr  6 16:39:07 2017 GMT
            Not After : Apr  5 16:39:07 2042 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Subject Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 89EFEB25096BA4CCD40AF4FB8756F0A4843995974822020914C4E859D932B7F3
    SPKI SHA256: 7CD67C248F69D83FC2F9BB01DCB1F7AD67A363D046043796D0984C3A231F6BB0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### SSL.com EV RSA SSL subCA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV RSA SSL subCA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA
- Serial: 4E1AC09194F3E916
- SHA-256: 97F6B9EEA4C24E07545A6A0242C8BB1D871E19FE03CFC30B99567971AE65F0A3
- SPKI SHA-256: 01BAF248DEB874D2F588E44AEC5C02C9B869FCE530EE6562D29C6396350A48E9
- Validity: 2016-02-12 to 2031-02-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVrsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5628022415854659862 (0x4e1ac09194f3e916)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA
        Validity
            Not Before: Feb 12 19:25:50 2016 GMT
            Not After : Feb 12 19:25:50 2031 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV RSA SSL subCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Subject Key Identifier:
                5B:29:EB:84:76:E7:52:FC:9A:01:E1:6B:64:AD:E0:D4:9D:3C:A4:01
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                D9:5A:2A:FF:A5:CE:9D:A1:91:7D:FF:87:5D:AB:6A:35:12:D9:C9:4C
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVrsa-RootCA.crl
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 97F6B9EEA4C24E07545A6A0242C8BB1D871E19FE03CFC30B99567971AE65F0A3
    SPKI SHA256: 01BAF248DEB874D2F588E44AEC5C02C9B869FCE530EE6562D29C6396350A48E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVrsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### SSL.com EV SSL Enterprise Intermediate CA RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Enterprise Intermediate CA RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 72EB6EF3C519A72408D15AA24DEB68F0
- SHA-256: 9B25A6A7BD51BC5F5C4F06E0D1218FD370DD31FAFD5CD3B627C82F202F1B4657
- SPKI SHA-256: BDC2FA9153F78CFF216D39F903EB7229ED4858858116786F52F6B7AA6BC41B62
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-EV-SSL-RSA-4096-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:eb:6e:f3:c5:19:a7:24:08:d1:5a:a2:4d:eb:68:f0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Mar 26 17:36:01 2019 GMT
            Not After : Mar 22 17:36:01 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Enterprise Intermediate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                A8:CB:46:86:9C:D0:A1:CA:C1:94:43:94:30:0A:72:03:F4:11:CA:EE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9B25A6A7BD51BC5F5C4F06E0D1218FD370DD31FAFD5CD3B627C82F202F1B4657
    SPKI SHA256: BDC2FA9153F78CFF216D39F903EB7229ED4858858116786F52F6B7AA6BC41B62
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV SSL Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 3C7D3BE67FA3ED6D30EBD0F0B4DF839C
- SHA-256: 8394E3D07EFCD1E97EA6CBA214C3A055C17DD9A7EBF8DDE0020FCDDB76F28653
- SPKI SHA-256: 775B4AB91D9A1459E1C3C79106835E8BBB01E18591D62426384986077DFB0349
- Validity: 2019-03-07 to 2034-03-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-SSL-ECC-384-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:7d:3b:e6:7f:a3:ed:6d:30:eb:d0:f0:b4:df:83:9c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:39:35 2019 GMT
            Not After : Mar  3 19:39:35 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
            X509v3 Subject Key Identifier:
                84:EE:F8:79:3E:08:64:76:48:64:39:F5:B1:BF:8B:02:5E:0B:BC:27
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8394E3D07EFCD1E97EA6CBA214C3A055C17DD9A7EBF8DDE0020FCDDB76F28653
    SPKI SHA256: 775B4AB91D9A1459E1C3C79106835E8BBB01E18591D62426384986077DFB0349
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-EVecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV SSL Intermediate CA RSA R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Intermediate CA RSA R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 52A80527AE71E675
- SHA-256: EFCB094B99DCCDE5A89599ECA85C4DA44FDE7B651DF0EF8B4D130D414FB35905
- SPKI SHA-256: 4539A87A0ABD6C5DDE95D94D4CCE0F35057D895DB4CF66CDD7FB55629FDF913C
- Validity: 2017-04-06 to 2032-04-06
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-SSL-RSA-4096-R2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5956016175186044533 (0x52a80527ae71e675)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Apr  6 16:57:34 2017 GMT
            Not After : Apr  6 16:57:34 2032 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Intermediate CA RSA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/certs/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                0A:1E:58:7B:90:C0:1B:67:B1:89:1A:98:B3:D9:67:E2:87:2F:78:09
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EFCB094B99DCCDE5A89599ECA85C4DA44FDE7B651DF0EF8B4D130D414FB35905
    SPKI SHA256: 4539A87A0ABD6C5DDE95D94D4CCE0F35057D895DB4CF66CDD7FB55629FDF913C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/certs/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV SSL Intermediate CA RSA R3

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV SSL Intermediate CA RSA R3
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 03A3F4D0603052A337CE380A8830318C
- SHA-256: 85DB0BEED0668D04D7074000F98E84B08D0FD5429FF4A262DE7CBC1528A1A1DA
- SPKI SHA-256: E15E8A26FD3D8F8C024DD075906F3EADF33B5C2131604A625C21B324D2F9F084
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-SSL-RSA-4096-R3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:a3:f4:d0:60:30:52:a3:37:ce:38:0a:88:30:31:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Mar 26 17:46:53 2019 GMT
            Not After : Mar 22 17:46:53 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV SSL Intermediate CA RSA R3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                BF:C1:5A:87:FF:28:FA:41:3D:FD:B7:4F:E4:1D:AF:A0:61:58:29:BD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 85DB0BEED0668D04D7074000F98E84B08D0FD5429FF4A262DE7CBC1528A1A1DA
    SPKI SHA256: E15E8A26FD3D8F8C024DD075906F3EADF33B5C2131604A625C21B324D2F9F084
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV Timestamping Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com EV Timestamping Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 01DEE6CEC92B46D8
- SHA-256: 554E3AE314AFF264D3FDE7F2BBC818F2E734D94B336208EDEFE7C37B162B6A96
- SPKI SHA-256: 81A455F51EF141AF1CEA8BFFD99AB6B942EE46F8DA70FA33D3A4131B82C1D21D
- Validity: 2017-04-06 to 2032-04-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-EV-TimeStamping-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 134798814680401624 (0x1dee6cec92b46d8)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Apr  6 17:10:55 2017 GMT
            Not After : Apr  5 17:10:55 2032 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com EV Timestamping Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/certs/SSLcom-RootCA-EV-RSA-4096-R2.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Name Constraints:
                Excluded:
                  DNS:
                  IP:0.0.0.0/0.0.0.0
                  IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                F9:2C:DD:7C:83:42:3B:61:AE:AF:B2:27:A2:95:53:F8:7D:26:AC:88
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 554E3AE314AFF264D3FDE7F2BBC818F2E734D94B336208EDEFE7C37B162B6A96
    SPKI SHA256: 81A455F51EF141AF1CEA8BFFD99AB6B942EE46F8DA70FA33D3A4131B82C1D21D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/certs/SSLcom-RootCA-EV-RSA-4096-R2.crt
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":true,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ext_name_constraints_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_name_constraints
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV TLS Issuing ECC CA R1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Issuing ECC CA R1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 583D15217B32627E14E548DF135081A9
- SHA-256: 68255D5EA52D2CA9A0B1F8EFF8F446CECC95A80A5D880DB681F1630C0B4B214D
- SPKI SHA-256: 702AB0CDE326718F46030A06D42160B845073C8F0C1069E0D625A67CF820E87E
- Validity: 2022-10-21 to 2032-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVTLS-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:3d:15:21:7b:32:62:7e:14:e5:48:df:13:50:81:a9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Oct 21 17:03:05 2022 GMT
            Not After : Oct 18 17:03:04 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com EV TLS Issuing ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                9B:89:70:8E:A7:57:1D:61:95:29:9D:A9:A9:EE:57:94:5B:F6:EA:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 68255D5EA52D2CA9A0B1F8EFF8F446CECC95A80A5D880DB681F1630C0B4B214D
    SPKI SHA256: 702AB0CDE326718F46030A06D42160B845073C8F0C1069E0D625A67CF820E87E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV TLS Issuing RSA CA R1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Issuing RSA CA R1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 3A680DCA7D82C0834B3289D12A7F00F4
- SHA-256: ECBD2002FB15D690EB29CCA7371D97F84FAE7F1FF67BD039323BADAF5CAD9148
- SPKI SHA-256: DDE6CD5A447AAA14AC5739375A46D7AA65B46AB78DC42FBEE94794FBE100F48A
- Validity: 2022-10-21 to 2032-10-18
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVTLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:68:0d:ca:7d:82:c0:83:4b:32:89:d1:2a:7f:00:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Oct 21 17:03:44 2022 GMT
            Not After : Oct 18 17:03:43 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com EV TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                D7:7C:79:F0:9B:08:B1:6B:90:6F:3D:0C:39:15:1E:F2:B6:1F:97:92
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ECBD2002FB15D690EB29CCA7371D97F84FAE7F1FF67BD039323BADAF5CAD9148
    SPKI SHA256: DDE6CD5A447AAA14AC5739375A46D7AA65B46AB78DC42FBEE94794FBE100F48A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV TLS Transit ECC CA R1

- Subject: countryName=US, organizationName=SSL Corp, commonName=SSL.com EV TLS Transit ECC CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 111E88BADAF80F1C4A3D6A689BC7644D
- SHA-256: 619079F100A6BFB65CB2E98890DD0AC492B64665E254A66A529D8F5917D82AB1
- SPKI SHA-256: 4C917FD7CF9CE9ACDEF69B58A210F256A5BCAA95C19C90C5BFB5626C9F0CC2B9
- Validity: 2022-02-28 to 2037-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:1e:88:ba:da:f8:0f:1c:4a:3d:6a:68:9b:c7:64:4d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Feb 28 21:29:44 2022 GMT
            Not After : Feb 24 21:29:43 2037 GMT
        Subject: C = US, O = SSL Corp, CN = SSL.com EV TLS Transit ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                32:30:EF:B7:62:0F:30:D0:D2:5B:52:D3:22:7E:76:6A:73:AC:D1:B5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 619079F100A6BFB65CB2E98890DD0AC492B64665E254A66A529D8F5917D82AB1
    SPKI SHA256: 4C917FD7CF9CE9ACDEF69B58A210F256A5BCAA95C19C90C5BFB5626C9F0CC2B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com EV TLS Transit ECC CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit ECC CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 6349848EE7D244F131A619CE3A921C5D
- SHA-256: 4CF773F955FDB7A97DB1250F2FD7BA36075A96166BB5CC417B5C021D0F70ADF2
- SPKI SHA-256: 6219B0419471B8C30B4FA40ADDCA92077482B64281220A8E6140B55028B11943
- Validity: 2022-10-21 to 2037-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:49:84:8e:e7:d2:44:f1:31:a6:19:ce:3a:92:1c:5d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Oct 21 17:04:14 2022 GMT
            Not After : Oct 17 17:04:13 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit ECC CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                37:30:1E:64:2D:19:68:F3:FD:6E:B1:72:0D:EF:6C:FB:0A:40:4C:90
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4CF773F955FDB7A97DB1250F2FD7BA36075A96166BB5CC417B5C021D0F70ADF2
    SPKI SHA256: 6219B0419471B8C30B4FA40ADDCA92077482B64281220A8E6140B55028B11943
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com EV TLS Transit RSA CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit RSA CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 2171438CEDC2DD0473D5EC409E437328
- SHA-256: 6CC95D21D4C7BA39736E4E703E4260B7EFB6DCCD91431ED5C43D7E0986B39554
- SPKI SHA-256: 041D0965CF95854BBD9E2EB83CD98265654509930E2C60CA8DF67DF81F7DF374
- Validity: 2022-10-21 to 2037-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-EVTLS-T-RSA-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:71:43:8c:ed:c2:dd:04:73:d5:ec:40:9e:43:73:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Oct 21 17:04:26 2022 GMT
            Not After : Oct 17 17:04:25 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit RSA CA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                6F:0D:2F:A5:FA:75:F5:3A:F1:DF:EE:63:0B:D3:2C:27:CA:03:4F:75
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6CC95D21D4C7BA39736E4E703E4260B7EFB6DCCD91431ED5C43D7E0986B39554
    SPKI SHA256: 041D0965CF95854BBD9E2EB83CD98265654509930E2C60CA8DF67DF81F7DF374
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com IV TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 2D471B5CE9D1CE9588031B5FEF3DBFE9
- SHA-256: 41EFEF46FD0E434B644BB47E6E21182A8DEF59B1E6E1F2952587FA28BF10A4A2
- SPKI SHA-256: 65DE4214859D928F06752060BFDC48636BD02C3A6508A010813EDB46B14A715A
- Validity: 2022-12-09 to 2032-12-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-IVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:47:1b:5c:e9:d1:ce:95:88:03:1b:5f:ef:3d:bf:e9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Dec  9 18:27:35 2022 GMT
            Not After : Dec  6 18:27:34 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com IV TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                26:91:2F:B6:8A:80:BE:71:73:13:0A:01:B7:8C:7D:77:BF:5B:26:14
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 41EFEF46FD0E434B644BB47E6E21182A8DEF59B1E6E1F2952587FA28BF10A4A2
    SPKI SHA256: 65DE4214859D928F06752060BFDC48636BD02C3A6508A010813EDB46B14A715A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com IV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 61B0A3BC2F5E8F571B149A61DFFFF72D
- SHA-256: 0B9DF26FF87DF92EC265661EEC82D09F8A7531006F3CDA4D6F7288961B23B045
- SPKI SHA-256: 9A1CE10A8DC4104C972373E278E86D8747D568962F5ED4EED781D010524D435F
- Validity: 2022-12-09 to 2032-12-06
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-IVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:b0:a3:bc:2f:5e:8f:57:1b:14:9a:61:df:ff:f7:2d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Dec  9 18:28:11 2022 GMT
            Not After : Dec  6 18:28:10 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com IV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                AE:7D:16:FB:F4:32:27:F0:95:56:85:24:86:14:58:B4:5D:D1:9A:17
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0B9DF26FF87DF92EC265661EEC82D09F8A7531006F3CDA4D6F7288961B23B045
    SPKI SHA256: 9A1CE10A8DC4104C972373E278E86D8747D568962F5ED4EED781D010524D435F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com IV TLS Transit ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Transit ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 219DD98A5F3E1D613CA3A05A9A75DCFC
- SHA-256: 57D61F0944948124E9B7685C7E2C9B4344E75DA9588328ECDF936AC8E80B438E
- SPKI SHA-256: 52E8DFD8C3C0DF92E0E74021AE11463C444AFD91C3449C5CDD79B28F8DCF744B
- Validity: 2022-12-09 to 2037-12-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-IVTLS-T-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:9d:d9:8a:5f:3e:1d:61:3c:a3:a0:5a:9a:75:dc:fc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Dec  9 18:28:31 2022 GMT
            Not After : Dec  5 18:28:30 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com IV TLS Transit ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                B3:39:F3:9C:02:42:D8:D2:3D:D9:C1:D5:EA:41:65:93:BC:D8:0A:0B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 57D61F0944948124E9B7685C7E2C9B4344E75DA9588328ECDF936AC8E80B438E
    SPKI SHA256: 52E8DFD8C3C0DF92E0E74021AE11463C444AFD91C3449C5CDD79B28F8DCF744B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com IV TLS Transit RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com IV TLS Transit RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 1ED84C79C084DCF4FAF7413E3547C443
- SHA-256: C05F6E75226A6FFDF4A07A6D7473D3C51E66A57FE81138815539157DD57C5A59
- SPKI SHA-256: 47F3B9249F5B89732D1279A2383A6E901B5E1707C9334317C105A24AC8C900B4
- Validity: 2022-12-09 to 2037-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-IVTLS-T-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:d8:4c:79:c0:84:dc:f4:fa:f7:41:3e:35:47:c4:43
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Dec  9 18:28:45 2022 GMT
            Not After : Dec  5 18:28:44 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com IV TLS Transit RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                AE:DB:11:8C:61:8B:F0:CE:45:03:CE:EA:9A:DD:1F:EC:D7:8B:98:7F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C05F6E75226A6FFDF4A07A6D7473D3C51E66A57FE81138815539157DD57C5A59
    SPKI SHA256: 47F3B9249F5B89732D1279A2383A6E901B5E1707C9334317C105A24AC8C900B4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com NAESB Client Authentication Intermediate CA ECC R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com NAESB Client Authentication Intermediate CA ECC R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 3222A28694D7C599
- SHA-256: 18E4EB2C26E2331D69BBD32EBF66245C81EB2EE39C415B0411BB9329AF3A71A5
- SPKI SHA-256: 1F8AF8DFA8AC898EBE0524C93B43C3C4A3624616D914DD7BF4E41CA288461BD6
- Validity: 2018-12-17 to 2033-12-13
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-NAESB-clientAuth-ECC-384-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3612628550011045273 (0x3222a28694d7c599)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec 17 19:47:24 2018 GMT
            Not After : Dec 13 19:47:24 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com NAESB Client Authentication Intermediate CA ECC R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                97:6C:50:0E:2D:5C:46:18:A0:08:B1:A3:EB:97:D8:8A:F6:E0:00:EB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 18E4EB2C26E2331D69BBD32EBF66245C81EB2EE39C415B0411BB9329AF3A71A5
    SPKI SHA256: 1F8AF8DFA8AC898EBE0524C93B43C3C4A3624616D914DD7BF4E41CA288461BD6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com NAESB Client Authentication Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com NAESB Client Authentication Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 4216E3D15844A123AFC36FB23B6B5F8B
- SHA-256: 1BD9D336C9045DC17426B99AC2652FAE31CB9DC2AC3E19B04390C24B0BD4A8A0
- SPKI SHA-256: F97148EF8CBFDD28B5DDB415A94EE97AA96FFC19B507AD944C9CEF13A556D1E8
- Validity: 2019-03-07 to 2034-03-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-NAESB-clientAuth-ECC-384-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:16:e3:d1:58:44:a1:23:af:c3:6f:b2:3b:6b:5f:8b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:41:03 2019 GMT
            Not After : Mar  3 19:41:03 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com NAESB Client Authentication Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                84:DE:B7:77:40:72:A1:5D:58:9C:AB:B8:BE:63:F2:A4:DA:39:F1:F8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1BD9D336C9045DC17426B99AC2652FAE31CB9DC2AC3E19B04390C24B0BD4A8A0
    SPKI SHA256: F97148EF8CBFDD28B5DDB415A94EE97AA96FFC19B507AD944C9CEF13A556D1E8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com NAESB Client Authentication Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com NAESB Client Authentication Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 473DAA1ABD3D0B2D
- SHA-256: FC3F577DF125232A08E63DDA9AD74E10755750E1DFC80A9BF5281F411AE4C0EB
- SPKI SHA-256: EC2B44E3D11BA6F5ECA40D40E72D0B0FBFF6FE38503DF78D0365060A09AE9573
- Validity: 2018-07-06 to 2033-07-02
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-NAESB-clientAuth-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5133446182092999469 (0x473daa1abd3d0b2d)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Jul  6 15:52:49 2018 GMT
            Not After : Jul  2 15:52:49 2033 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com NAESB Client Authentication Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                7B:B0:37:62:D2:90:25:89:D4:97:FE:31:A6:C1:45:54:7A:32:88:6D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FC3F577DF125232A08E63DDA9AD74E10755750E1DFC80A9BF5281F411AE4C0EB
    SPKI SHA256: EC2B44E3D11BA6F5ECA40D40E72D0B0FBFF6FE38503DF78D0365060A09AE9573
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### SSL.com OV TLS Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 3072D5849622DD9E945573B4B3B7B679
- SHA-256: F1728DCAF61A28069EEA0FA1B482DD61A463F75255DD700CF60607E75E93C9A9
- SPKI SHA-256: FF580992DD019595FCF222659678A4E811E0FCC2DB61B6E76FE6109AF27141A9
- Validity: 2022-12-09 to 2032-12-06
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-OVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:72:d5:84:96:22:dd:9e:94:55:73:b4:b3:b7:b6:79
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Dec  9 18:29:03 2022 GMT
            Not After : Dec  6 18:29:02 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com OV TLS Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                D5:AF:BE:86:5A:64:56:EB:74:04:54:CE:68:5A:15:8B:00:1E:6A:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F1728DCAF61A28069EEA0FA1B482DD61A463F75255DD700CF60607E75E93C9A9
    SPKI SHA256: FF580992DD019595FCF222659678A4E811E0FCC2DB61B6E76FE6109AF27141A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com OV TLS Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 224A7C2265EDFCD42753BDC949FE8440
- SHA-256: 604BDD260A28EDD256E9DAA70C05CD18AC3CEC827F842590D45EA42BDDC61E42
- SPKI SHA-256: 8408C77BEDC1CA42258232CD4CE58B30349A340EE25833017FDBCC1D017105F3
- Validity: 2022-12-09 to 2032-12-06
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-OVTLS-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:4a:7c:22:65:ed:fc:d4:27:53:bd:c9:49:fe:84:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Dec  9 18:29:16 2022 GMT
            Not After : Dec  6 18:29:15 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com OV TLS Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                45:A2:14:85:D3:15:4A:99:70:F9:02:46:DC:CD:18:EA:E8:26:02:3A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 604BDD260A28EDD256E9DAA70C05CD18AC3CEC827F842590D45EA42BDDC61E42
    SPKI SHA256: 8408C77BEDC1CA42258232CD4CE58B30349A340EE25833017FDBCC1D017105F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com OV TLS Transit ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Transit ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 1A1C8B5447456831154E0EA0B75ED6AC
- SHA-256: 0DA999DF66FD21CAFF5E1376ABAD37B4FD2C8AA69B25A3F60794E6F3AA47D98B
- SPKI SHA-256: 44504438D9869E8B4138CD4736D371D27A9EA8FAA770FAE1C5666E125D12BC18
- Validity: 2022-12-09 to 2037-12-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-OVTLS-T-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:1c:8b:54:47:45:68:31:15:4e:0e:a0:b7:5e:d6:ac
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Dec  9 18:29:33 2022 GMT
            Not After : Dec  5 18:29:32 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com OV TLS Transit ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                B1:E0:D9:BF:9D:4B:7C:A1:2F:CA:69:43:56:28:56:4F:69:9C:17:6D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0DA999DF66FD21CAFF5E1376ABAD37B4FD2C8AA69B25A3F60794E6F3AA47D98B
    SPKI SHA256: 44504438D9869E8B4138CD4736D371D27A9EA8FAA770FAE1C5666E125D12BC18
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com OV TLS Transit RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Transit RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 17A231B2465AF7AA194278E5A7058788
- SHA-256: 2858D518D0774088CFE7BD5E52AAFD15C450B63C667C9F575EB22C084FC2318C
- SPKI SHA-256: A341D850AD5E66749977DA49E15256CD8C1784CFCA77BEDF52A91C6C080FC814
- Validity: 2022-12-09 to 2037-12-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-OVTLS-T-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            17:a2:31:b2:46:5a:f7:aa:19:42:78:e5:a7:05:87:88
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Dec  9 18:29:46 2022 GMT
            Not After : Dec  5 18:29:45 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com OV TLS Transit RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                E4:AB:EB:75:33:DD:84:5B:48:EE:CD:66:6E:B1:53:19:EB:08:8B:96
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2858D518D0774088CFE7BD5E52AAFD15C450B63C667C9F575EB22C084FC2318C
    SPKI SHA256: A341D850AD5E66749977DA49E15256CD8C1784CFCA77BEDF52A91C6C080FC814
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07EE24A9B6DB40F35FCE4E91B8313A51AE49B5
- SHA-256: 3F47228BD9AC6738F87A806336673127CE2E3DA0DFFA0793355EE2EFFF203B9E
- SPKI SHA-256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
- Validity: 2026-01-15 to 2034-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:b6:db:40:f3:5f:ce:4e:91:b8:31:3a:51:ae:49:b5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 15 13:09:21 2026 GMT
            Not After : Dec 30 19:09:21 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3F47228BD9AC6738F87A806336673127CE2E3DA0DFFA0793355EE2EFFF203B9E
    SPKI SHA256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 3F2C608C5CF96321
- SHA-256: 06B9722A699C57DFF1869F430B479BB6EB49AAE1184EAC9C5325C1334A34EA4C
- SPKI SHA-256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
- Validity: 2019-02-14 to 2027-02-12
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4552119479336264481 (0x3f2c608c5cf96321)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 14 18:07:08 2019 GMT
            Not After : Feb 12 18:07:08 2027 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 06B9722A699C57DFF1869F430B479BB6EB49AAE1184EAC9C5325C1334A34EA4C
    SPKI SHA256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- expires_within_398_days

### SSL.com Root Certification Authority ECC

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EE24A9C0A66AA6AB098F3516EB583DB2D5DA
- SHA-256: A272F56F844FD9F8979FFF8C3CB18621454CB15BA419FC4427824B7BCD2D29B6
- SPKI SHA-256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
- Validity: 2026-01-15 to 2029-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:c0:a6:6a:a6:ab:09:8f:35:16:eb:58:3d:b2:d5:da
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2029 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A272F56F844FD9F8979FFF8C3CB18621454CB15BA419FC4427824B7BCD2D29B6
    SPKI SHA256: A320F4D534D7BE97C1AE8DD0499735BC895C323ADD2D388BFCCF662C23D7F99A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Root Certification Authority RSA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07EE24A9B59C4C083B546DF1B2BBDB375CCFFD
- SHA-256: 3F7BEFCE41F251B2282018FB73213A2116A3F4F692389335E04FF5AE33AB45DA
- SPKI SHA-256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
- Validity: 2026-01-15 to 2034-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:b5:9c:4c:08:3b:54:6d:f1:b2:bb:db:37:5c:cf:fd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 15 13:09:21 2026 GMT
            Not After : Dec 30 19:09:21 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3F7BEFCE41F251B2282018FB73213A2116A3F4F692389335E04FF5AE33AB45DA
    SPKI SHA256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Root Certification Authority RSA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EB4240D8FF6F0D83A1DBCF0A9F730E2F304A
- SHA-256: B3E86467D178F3CEBE11E739FC2169E4C7859078EC63FB40318981EF3A4EAB26
- SPKI SHA-256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
- Validity: 2025-12-17 to 2029-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:eb:42:40:d8:ff:6f:0d:83:a1:db:cf:0a:9f:73:0e:2f:30:4a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Dec 17 11:11:24 2025 GMT
            Not After : Dec 30 17:11:24 2029 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B3E86467D178F3CEBE11E739FC2169E4C7859078EC63FB40318981EF3A4EAB26
    SPKI SHA256: D1C45377EBDCD618CD1651DC2E02C21D751E5AA9FCD1B3431FF6ECF6A31348FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com RSA SSL subCA

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com RSA SSL subCA
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 0997ED109D1F07FC
- SHA-256: 527A60B02ABF3A4A5519C4F62FBBD560E3034074EEEC8B8799AA9368693FE36D
- SPKI SHA-256: ECB701E59F004D5CF8ADC42D218E71262AFCFFE1777BF1CF8BC2037429E309A1
- Validity: 2016-02-12 to 2031-02-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-SSL-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 691281723435976700 (0x997ed109d1f07fc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 12 18:48:52 2016 GMT
            Not After : Feb 12 18:48:52 2031 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com RSA SSL subCA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Subject Key Identifier:
                26:14:7E:E0:DC:D7:A6:F7:E2:D4:04:27:DF:61:F1:C2:EC:E7:32:CA
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 527A60B02ABF3A4A5519C4F62FBBD560E3034074EEEC8B8799AA9368693FE36D
    SPKI SHA256: ECB701E59F004D5CF8ADC42D218E71262AFCFFE1777BF1CF8BC2037429E309A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp

### SSL.com S/MIME Issuing ECC CA R1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Issuing ECC CA R1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022
- Serial: 6B9C08D8EA19039D716CFD51F7555D64
- SHA-256: 26A29420D6B3DDFF25840D1C7930C15BF071EE10775738A63DE2A61A105E932A
- SPKI SHA-256: CC4CDCBC28848CE9AD8CE2AF6D8639779A39968B60588935DA913D54E1303798
- Validity: 2022-10-21 to 2032-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-SMIME-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:9c:08:d8:ea:19:03:9d:71:6c:fd:51:f7:55:5d:64
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client ECC Root CA 2022
        Validity
            Not Before: Oct 21 17:00:47 2022 GMT
            Not After : Oct 18 17:00:46 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com S/MIME Issuing ECC CA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B7:FE:2D:62:C5:81:53:CD:52:1A:2F:5D:60:A0:C3:5D:FB:B2:1C:1C
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                50:34:4F:94:60:0B:17:04:EC:61:93:8F:3F:33:5F:DB:F1:FC:68:38
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 26A29420D6B3DDFF25840D1C7930C15BF071EE10775738A63DE2A61A105E932A
    SPKI SHA256: CC4CDCBC28848CE9AD8CE2AF6D8639779A39968B60588935DA913D54E1303798
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com S/MIME Issuing RSA CA R1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Issuing RSA CA R1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022
- Serial: 6A71E3EA7C4A993DC14A3422C6F62050
- SHA-256: 030FE47ECE258C2EFEF45FE8FFCA62D14DB33F0212188E3B10D739797D29E28A
- SPKI SHA-256: 7EC3523A15B408E114FD6688FE5BCE492526F75C86D31EC4876A3E286C782619
- Validity: 2022-10-21 to 2032-10-18
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:71:e3:ea:7c:4a:99:3d:c1:4a:34:22:c6:f6:20:50
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client RSA Root CA 2022
        Validity
            Not Before: Oct 21 17:00:59 2022 GMT
            Not After : Oct 18 17:00:58 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com S/MIME Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F0:38:42:94:34:A9:3C:00:7F:52:EE:39:A5:F7:4B:0D:BC:6A:7D:23
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                8F:02:BE:C8:B0:62:5F:7B:44:96:38:66:1B:FF:88:3A:8C:D0:32:38
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 030FE47ECE258C2EFEF45FE8FFCA62D14DB33F0212188E3B10D739797D29E28A
    SPKI SHA256: 7EC3523A15B408E114FD6688FE5BCE492526F75C86D31EC4876A3E286C782619
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com S/MIME Transit ECC CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit ECC CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client ECC Root CA 2022
- Serial: 6383BBDEE1B11B1505F58685C9880698
- SHA-256: B6DAF35F591A2B30CDAC188D7A8F542C45E5560EFD607B984A306A8A755DA92E
- SPKI SHA-256: 7A35ABA287446390051E42C5435CCFDCFF8977E63876A1482CFB54A90C0E0DF9
- Validity: 2022-10-21 to 2037-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-SMIME-T-ECC-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:83:bb:de:e1:b1:1b:15:05:f5:86:85:c9:88:06:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client ECC Root CA 2022
        Validity
            Not Before: Oct 21 17:01:11 2022 GMT
            Not After : Oct 17 17:01:10 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com S/MIME Transit ECC CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                B7:FE:2D:62:C5:81:53:CD:52:1A:2F:5D:60:A0:C3:5D:FB:B2:1C:1C
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                6F:52:2C:15:1F:D3:28:2B:BF:DB:8D:EF:04:25:BF:40:F1:BC:C2:CD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B6DAF35F591A2B30CDAC188D7A8F542C45E5560EFD607B984A306A8A755DA92E
    SPKI SHA256: 7A35ABA287446390051E42C5435CCFDCFF8977E63876A1482CFB54A90C0E0DF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com S/MIME Transit RSA CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit RSA CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Client RSA Root CA 2022
- Serial: 12C69C81431E37D6BEA3DC716EA0DD1D
- SHA-256: C3251AB91CC593221FE36D9D5701A5AC531532AFEA816976611F5180995FDDCB
- SPKI SHA-256: D7B2A9B2AC5850602FBF7EB9087CAB1D8107672C267E74975C09FA9A628C5DC8
- Validity: 2022-10-21 to 2037-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:c6:9c:81:43:1e:37:d6:be:a3:dc:71:6e:a0:dd:1d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Client RSA Root CA 2022
        Validity
            Not Before: Oct 21 17:01:31 2022 GMT
            Not After : Oct 17 17:01:30 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com S/MIME Transit RSA CA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                F0:38:42:94:34:A9:3C:00:7F:52:EE:39:A5:F7:4B:0D:BC:6A:7D:23
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                F8:73:64:82:77:12:8C:7E:A4:3D:6A:05:0A:58:FF:AA:E8:51:B6:39
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C3251AB91CC593221FE36D9D5701A5AC531532AFEA816976611F5180995FDDCB
    SPKI SHA256: D7B2A9B2AC5850602FBF7EB9087CAB1D8107672C267E74975C09FA9A628C5DC8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-Client-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-Client-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com SecureTrust TLS Issuing RSA CA R1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com SecureTrust TLS Issuing RSA CA R1
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EE24A9C4458B9F79BCF9808896598782A472
- SHA-256: F1A05F6936FC0B814D21AE52B869F4E741B222A08A622E5D535B331DCD71E49C
- SPKI SHA-256: A0D46DCC58C4C4DE6E0FCA8A91DE4AF3F31B7B54191D54DFEA169DA15A576AD2
- Validity: 2026-01-15 to 2029-12-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:c4:45:8b:9f:79:bc:f9:80:88:96:59:87:82:a4:72
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2029 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com SecureTrust TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                DA:DF:B6:35:30:96:74:1B:06:5A:42:03:06:22:F3:66:AE:8C:84:4B
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F1A05F6936FC0B814D21AE52B869F4E741B222A08A622E5D535B331DCD71E49C
    SPKI SHA256: A0D46DCC58C4C4DE6E0FCA8A91DE4AF3F31B7B54191D54DFEA169DA15A576AD2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_invalid_ca_certificate_policies: At least one CABF reserved policy OIDs MUST be present in a policy-restricted CA cert

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com SecureTrust TLS OV Issuing RSA CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com SecureTrust TLS OV Issuing RSA CA R2
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EF85E16C8022EB1850DDFB62F668FC119D55
- SHA-256: 98B2C87811384E05264E35C020CFBE2346A25A2B26B8B4C6EE88848B32566A30
- SPKI SHA-256: A0D46DCC58C4C4DE6E0FCA8A91DE4AF3F31B7B54191D54DFEA169DA15A576AD2
- Validity: 2026-01-29 to 2029-12-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Securetrust-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.38064.1.3.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ef:85:e1:6c:80:22:eb:18:50:dd:fb:62:f6:68:fc:11:9d:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jan 29 11:01:39 2026 GMT
            Not After : Dec 28 17:01:39 2029 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com SecureTrust TLS OV Issuing RSA CA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                DA:DF:B6:35:30:96:74:1B:06:5A:42:03:06:22:F3:66:AE:8C:84:4B
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 98B2C87811384E05264E35C020CFBE2346A25A2B26B8B4C6EE88848B32566A30
    SPKI SHA256: A0D46DCC58C4C4DE6E0FCA8A91DE4AF3F31B7B54191D54DFEA169DA15A576AD2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.3.6.1.4.1.38064.1.3.1.2
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com SSL Enterprise Intermediate CA RSA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 7A46093E237CBBA8D021CE1C70AAF00C
- SHA-256: EDAC9C45909F4DEC7BB65F0A4FBF6A8A0375E52AEDD66E06888FED7E3EDEC537
- SPKI SHA-256: A0A0293690CBDA1CEF07A7EA37AC9F5B16DDA3117696F9D564BC36E1CF4C3565
- Validity: 2019-03-26 to 2034-03-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:46:09:3e:23:7c:bb:a8:d0:21:ce:1c:70:aa:f0:0c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Mar 26 17:38:13 2019 GMT
            Not After : Mar 22 17:38:13 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EDAC9C45909F4DEC7BB65F0A4FBF6A8A0375E52AEDD66E06888FED7E3EDEC537
    SPKI SHA256: A0A0293690CBDA1CEF07A7EA37AC9F5B16DDA3117696F9D564BC36E1CF4C3565
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com SSL Intermediate CA ECC R2

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Intermediate CA ECC R2
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 1CD71212DE1510D91282DA33104A102F
- SHA-256: 948B7111AF42F546D579CFF5CE2BDEC82134DD9914842BDDB0C52872EB604E39
- SPKI SHA-256: CC6800E0E5380E325DBE945852A6E2E5587683D5B939CFCF80A8A1CBD9A42EC1
- Validity: 2019-03-07 to 2034-03-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-SubCA-SSL-ECC-384-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:d7:12:12:de:15:10:d9:12:82:da:33:10:4a:10:2f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Mar  7 19:42:42 2019 GMT
            Not After : Mar  3 19:42:42 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Intermediate CA ECC R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                0D:74:66:0A:5E:9F:E2:2C:EC:D5:C2:5D:25:04:7F:75:32:BA:FF:7D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 948B7111AF42F546D579CFF5CE2BDEC82134DD9914842BDDB0C52872EB604E39
    SPKI SHA256: CC6800E0E5380E325DBE945852A6E2E5587683D5B939CFCF80A8A1CBD9A42EC1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com Timestamping Issuing RSA CA R1

- Subject: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Timestamping Issuing RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 6D52187087E8234D856000D0808F9356
- SHA-256: 5F4D2C0E0CBA7D1FB600EDD3506D4331C866A11F20D137054EE39CF514576679
- SPKI SHA-256: 4A25BA3FADE1C4ACA4EE4CA968ECEEBBA567ECA8BB51724266390BB4521C3C21
- Validity: 2019-11-13 to 2034-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Nov 13 18:50:05 2019 GMT
            Not After : Nov 12 18:50:05 2034 GMT
        Subject: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Timestamping Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                0C:9D:10:25:8E:9A:A7:1B:99:87:43:CF:08:7E:E1:BD:81:90:F4:CF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5F4D2C0E0CBA7D1FB600EDD3506D4331C866A11F20D137054EE39CF514576679
    SPKI SHA256: 4A25BA3FADE1C4ACA4EE4CA968ECEEBBA567ECA8BB51724266390BB4521C3C21
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 435539DF81B90DACA3CB5CE42BECB3BD
- SHA-256: 1E6EBEF80676FD20D2597C1F45A5E198DD4C4CBF3328E522837196600C319141
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2025-02-18 to 2040-02-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:55:39:df:81:b9:0d:ac:a3:cb:5c:e4:2b:ec:b3:bd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Feb 18 16:36:10 2025 GMT
            Not After : Feb 15 16:36:09 2040 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1E6EBEF80676FD20D2597C1F45A5E198DD4C4CBF3328E522837196600C319141
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 07F14EE6DFAFA03D9B8276453728C8A3474586
- SHA-256: A1878AE6E6D02EEAA10199924DEC398AD285CFE2E3904B5F668D925A23A4561C
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2026-02-16 to 2042-08-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:f1:4e:e6:df:af:a0:3d:9b:82:76:45:37:28:c8:a3:47:45:86
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb 16 11:01:02 2026 GMT
            Not After : Aug 21 17:01:02 2042 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A1878AE6E6D02EEAA10199924DEC398AD285CFE2E3904B5F668D925A23A4561C
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority ECC
- Serial: 3B0E701D53CBB71450A231960F41999C
- SHA-256: AC25863BA43B96AEA864BA2AA256022AF9D38DC93E97437F3DE603CC487306CB
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2023-11-07 to 2038-11-03
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:0e:70:1d:53:cb:b7:14:50:a2:31:96:0f:41:99:9c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority ECC
        Validity
            Not Before: Nov  7 17:26:27 2023 GMT
            Not After : Nov  3 17:26:26 2038 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                5B:CA:5E:E5:DE:D2:81:AA:CD:A8:2D:64:51:B6:D9:72:9B:97:E6:4F
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: AC25863BA43B96AEA864BA2AA256022AF9D38DC93E97437F3DE603CC487306CB
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-ECC-384-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EB4281BE1A1011E552C13831E2947E9AF848
- SHA-256: 469A5624CBF125C29B1C73AA4D05D4B2BF4F8400B5D569E9A4CA554AB4C4FAF5
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2025-12-17 to 2029-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:eb:42:81:be:1a:10:11:e5:52:c1:38:31:e2:94:7e:9a:f8:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Dec 17 11:25:46 2025 GMT
            Not After : Dec 30 17:25:46 2029 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 469A5624CBF125C29B1C73AA4D05D4B2BF4F8400B5D569E9A4CA554AB4C4FAF5
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07EE24A9BB2251D8CFBC591593BADF750F7555
- SHA-256: 5DA2AA591B0F1DE7FF0C0D95DF3424A1FC683E3309AD3ACCBFA783CE93CCDF13
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2026-01-15 to 2034-12-30
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:bb:22:51:d8:cf:bc:59:15:93:ba:df:75:0f:75:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2034 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5DA2AA591B0F1DE7FF0C0D95DF3424A1FC683E3309AD3ACCBFA783CE93CCDF13
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS ECC Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 07F14EE6DE7CF3B2E7038EE66455948A85C709
- SHA-256: 08D48685EF84C770B441F6365D707B1C7AA293AE2FD7AA159A24451380C60134
- SPKI SHA-256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
- Validity: 2026-02-16 to 2042-08-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:f1:4e:e6:de:7c:f3:b2:e7:03:8e:e6:64:55:94:8a:85:c7:09
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb 16 11:01:02 2026 GMT
            Not After : Aug 21 17:01:02 2042 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 08D48685EF84C770B441F6365D707B1C7AA293AE2FD7AA159A24451380C60134
    SPKI SHA256: 1BF00D5C8F13C094DD17E00504CF0888850F12FD067FA1F92C0FDBF60B86E321
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS Issuing ECC CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Issuing ECC CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 5D7443B994D321F267F204F1844AC732
- SHA-256: 7F3EE6366236EDE6C1F7C21C443C644D32153EDAA9357C3A6DA879CDF2A6B0B6
- SPKI SHA-256: 34F46B064F7AB7AE2F6B2F376BC29FEE42D5F1599D8BFD7B420A5EB37DBCFCF9
- Validity: 2022-10-21 to 2032-10-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-TLS-I-ECC-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5d:74:43:b9:94:d3:21:f2:67:f2:04:f1:84:4a:c7:32
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Oct 21 17:01:46 2022 GMT
            Not After : Oct 18 17:01:45 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS Issuing ECC CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                4E:B9:52:5A:B1:8F:7E:D6:30:53:43:E5:CA:5D:A2:04:8C:4C:14:F4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7F3EE6366236EDE6C1F7C21C443C644D32153EDAA9357C3A6DA879CDF2A6B0B6
    SPKI SHA256: 34F46B064F7AB7AE2F6B2F376BC29FEE42D5F1599D8BFD7B420A5EB37DBCFCF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com TLS Issuing RSA CA R1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Issuing RSA CA R1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 26B9FFE4596FA61E1AF21C63D672748A
- SHA-256: BFBC39E9FA2B84C9A92337E2344EE2381D8D3D3AE8EA75EF4E48E5807ED80C69
- SPKI SHA-256: D052815719F277826AF2FF124FEDEC8CEF96A01ECF2C112949D8B16C71352F88
- Validity: 2022-10-21 to 2032-10-18
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:b9:ff:e4:59:6f:a6:1e:1a:f2:1c:63:d6:72:74:8a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Oct 21 17:02:03 2022 GMT
            Not After : Oct 18 17:02:02 2032 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                79:BA:94:77:A0:0D:19:DD:34:E6:39:A4:FC:4C:A5:D2:5A:6D:F5:8C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BFBC39E9FA2B84C9A92337E2344EE2381D8D3D3AE8EA75EF4E48E5807ED80C69
    SPKI SHA256: D052815719F277826AF2FF124FEDEC8CEF96A01ECF2C112949D8B16C71352F88
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com EV Root Certification Authority RSA R2
- Serial: 326F64E97034C6F7A3946A50A3ED04FE
- SHA-256: 6BCB147D41E9B577F40002A5C4BA08846737805AAFE8554DD0E72204F6007BA7
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2023-11-07 to 2038-11-03
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:6f:64:e9:70:34:c6:f7:a3:94:6a:50:a3:ed:04:fe
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com EV Root Certification Authority RSA R2
        Validity
            Not Before: Nov  7 17:25:44 2023 GMT
            Not After : Nov  3 17:25:43 2038 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                F9:60:BB:D4:E3:D5:34:F6:B8:F5:06:80:25:A7:73:DB:46:69:A8:9E
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6BCB147D41E9B577F40002A5C4BA08846737805AAFE8554DD0E72204F6007BA7
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07EB4274FC1D305BE94C9883277F8467E2144F
- SHA-256: 1B1DE06990CD0B305E2E124806103B1ADCFFC499F212504DC77F48DD0AD62209
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2025-12-17 to 2029-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:eb:42:74:fc:1d:30:5b:e9:4c:98:83:27:7f:84:67:e2:14:4f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Dec 17 11:22:57 2025 GMT
            Not After : Dec 30 17:22:57 2029 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1B1DE06990CD0B305E2E124806103B1ADCFFC499F212504DC77F48DD0AD62209
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Serial: 07F14EE6D92BBA2B87287AC29EDA21B8F530A8
- SHA-256: 2A2ABB81B6A23186F92D5B7E21FB5931467ACE1F7BD4AE4395BF4C4B8C026468
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2026-02-16 to 2029-12-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=74618eb1-53fb-4673-a374-ff5380e92e66, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5ab94bb-6d01-414c-b2c7-54dc3958b659
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:f1:4e:e6:d9:2b:ba:2b:87:28:7a:c2:9e:da:21:b8:f5:30:a8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Validity
            Not Before: Feb 16 11:01:01 2026 GMT
            Not After : Dec 28 17:01:01 2029 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Authority Key Identifier:
                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/SGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/SGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2A2ABB81B6A23186F92D5B7E21FB5931467ACE1F7BD4AE4395BF4C4B8C026468
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/SGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07EE24A9B9E6691FA4BD101CA845391DD39648
- SHA-256: 62702D3011652123DEA4690FA9B5270A21A110538FE561327BDA247F67AC9340
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2026-01-15 to 2034-12-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ee:24:a9:b9:e6:69:1f:a4:bd:10:1c:a8:45:39:1d:d3:96:48
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 15 13:09:22 2026 GMT
            Not After : Dec 30 19:09:22 2034 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 62702D3011652123DEA4690FA9B5270A21A110538FE561327BDA247F67AC9340
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 2D9DBDF460818EFB188B58EBE6D55FEA
- SHA-256: 336CD76B6C7F7878B3D4AB59B28982CBEE40804AABC9C2BEE98827B34CFFF2C0
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2025-02-18 to 2040-02-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:9d:bd:f4:60:81:8e:fb:18:8b:58:eb:e6:d5:5f:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Feb 18 16:35:05 2025 GMT
            Not After : Feb 15 16:35:04 2040 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 336CD76B6C7F7878B3D4AB59B28982CBEE40804AABC9C2BEE98827B34CFFF2C0
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-RootCA-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-RootCA-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com TLS RSA Root CA 2022

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 07F14EE6DC3B3BEC23451978FE0BCBBCF28649
- SHA-256: DC1E4EDF2B35CC811E967444FB5D13BC017DC7E86527EF8A5A35109EC14A1CF3
- SPKI SHA-256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
- Validity: 2026-02-16 to 2042-08-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SSL.com
- CP/CPS: https://legal.ssl.com/documents/SSLcom-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=cfaf89ae-b72e-4546-a0a9-b0805fcc24af, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=fbbde2d3-e011-4b03-84c6-3402a25e4ff7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=9472b171-1066-4541-a798-cc1ef1b84a4e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=96e94645-bf95-49b4-a37b-6ffe9607c5fb
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV, 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV, 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- CRL DP: http://crl.sslsecuretrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:f1:4e:e6:dc:3b:3b:ec:23:45:19:78:fe:0b:cb:bc:f2:86:49
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb 16 11:01:01 2026 GMT
            Not After : Aug 21 17:01:01 2042 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
                Policy: 2.23.140.1.2.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.1
                Policy: 1.3.6.1.4.1.38064.1.3.1.2
                Policy: 1.3.6.1.4.1.38064.1.3.1.3
                Policy: 1.3.6.1.4.1.38064.1.3.1.4
                Policy: 1.3.6.1.4.1.38064.1.3.1.5
                Policy: 1.3.6.1.4.1.38064.1.3.1.6
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.sslsecuretrust.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.sslsecuretrust.com/
                CA Issuers - URI:http://certs.sslsecuretrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DC1E4EDF2B35CC811E967444FB5D13BC017DC7E86527EF8A5A35109EC14A1CF3
    SPKI SHA256: 2BCF553A66F570900DDD32BA6DFE1ECC06C9182D662DC1B60E1F7B767C2BDD54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 2.23.140.1.2.1, 2.23.140.1.2.2, 2.23.140.1.2.3, 1.3.6.1.4.1.38064.1.3.1.1, 1.3.6.1.4.1.38064.1.3.1.2, 1.3.6.1.4.1.38064.1.3.1.3, 1.3.6.1.4.1.38064.1.3.1.4, 1.3.6.1.4.1.38064.1.3.1.5, 1.3.6.1.4.1.38064.1.3.1.6
- AIA OCSP: http://ocsp.sslsecuretrust.com/
- AIA CA Issuers: http://certs.sslsecuretrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.sslsecuretrust.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SSL.com TLS Transit ECC CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS ECC Root CA 2022
- Serial: 604D8AF8D00BA8748B955853172C5F2E
- SHA-256: 5D1BC399274E649E1C72697DE91A54AD725088C5221CB61E17EE9C290BC42A92
- SPKI SHA-256: 397CA3F6781BA8EF5C8CB78EFFEB7D1A097610FE094E75561EAE0B13084533DC
- Validity: 2022-10-21 to 2037-10-17
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:4d:8a:f8:d0:0b:a8:74:8b:95:58:53:17:2c:5f:2e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS ECC Root CA 2022
        Validity
            Not Before: Oct 21 17:02:23 2022 GMT
            Not After : Oct 17 17:02:22 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                89:8F:2F:A3:E8:2B:A0:14:54:7B:F3:56:B8:26:5F:67:38:0B:9C:D0
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
            X509v3 Subject Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5D1BC399274E649E1C72697DE91A54AD725088C5221CB61E17EE9C290BC42A92
    SPKI SHA256: 397CA3F6781BA8EF5C8CB78EFFEB7D1A097610FE094E75561EAE0B13084533DC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com TLS Transit RSA CA R2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS RSA Root CA 2022
- Serial: 20281DD386171EBF052045B337F2BD86
- SHA-256: FFE930442DFEB69CE29A908B6A639B370BD6BA6075F931AB83561D938B453A21
- SPKI SHA-256: BE7D1ED431296039CE59E3521F4224BAFAD2F2220013BC79681EC4A250D4C52D
- Validity: 2022-10-21 to 2037-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            20:28:1d:d3:86:17:1e:bf:05:20:45:b3:37:f2:bd:86
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS RSA Root CA 2022
        Validity
            Not Before: Oct 21 17:02:36 2022 GMT
            Not After : Oct 17 17:02:35 2037 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Authority Key Identifier:
                FB:2E:37:EE:E3:84:7A:27:2E:CD:19:35:B1:33:7C:FF:D4:44:42:B9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
            X509v3 Subject Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FFE930442DFEB69CE29A908B6A639B370BD6BA6075F931AB83561D938B453A21
    SPKI SHA256: BE7D1ED431296039CE59E3521F4224BAFAD2F2220013BC79681EC4A250D4C52D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSLcom-TLS-Root-2022-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSLcom-TLS-Root-2022-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com VMC Issuing ECC CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC Issuing ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC ECC Root CA 2024
- Serial: 524F9406C9B4449E04D384A2AC987A11
- SHA-256: EECC01DCC16B7DA945696AAE3A47D889024B2E8C31BB853CE276ABA780230F41
- SPKI SHA-256: 0156CA11CE7E921071E4465FAB01AE6AE0563689D4F40A24BF9F2A7A50417089
- Validity: 2024-03-26 to 2034-03-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-VMC-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-VMC-Root-2024-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:4f:94:06:c9:b4:44:9e:04:d3:84:a2:ac:98:7a:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com VMC ECC Root CA 2024
        Validity
            Not Before: Mar 26 17:04:19 2024 GMT
            Not After : Mar 24 17:04:18 2034 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com VMC Issuing ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                25:F0:C6:2A:E4:DE:22:A6:00:2D:F1:52:B8:27:8D:A0:51:E2:A0:A5
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-VMC-Root-2024-ECC.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Brand Indicator for Message Identification
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-VMC-Root-2024-ECC.crl
            X509v3 Subject Key Identifier:
                03:19:FD:F3:B9:D3:4B:B1:99:2C:86:1B:DF:2D:AC:3F:B5:44:1C:77
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EECC01DCC16B7DA945696AAE3A47D889024B2E8C31BB853CE276ABA780230F41
    SPKI SHA256: 0156CA11CE7E921071E4465FAB01AE6AE0563689D4F40A24BF9F2A7A50417089
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-VMC-Root-2024-ECC.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-VMC-Root-2024-ECC.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SSL.com VMC Issuing RSA CA 1

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC Issuing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com VMC RSA Root CA 2024
- Serial: 1EF7DF5CBFC453ED0AC42F35F2E65E2B
- SHA-256: 4B755C0495431F13FE25B455775264958541D5259E6ACB4226D490471CA7AE64
- SPKI SHA-256: 73E0A4709C70A15D296C75D7105B8CF29874F2B8981F1FF035D85726C1DA9736
- Validity: 2024-03-26 to 2034-03-24
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SSL.com-VMC-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1e:f7:df:5c:bf:c4:53:ed:0a:c4:2f:35:f2:e6:5e:2b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com VMC RSA Root CA 2024
        Validity
            Not Before: Mar 26 17:03:37 2024 GMT
            Not After : Mar 24 17:03:36 2034 GMT
        Subject: C = US, O = SSL Corporation, CN = SSL.com VMC Issuing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C1:35:A2:F4:59:D9:07:76:97:FD:CA:E8:6B:77:D6:26:AE:7A:5A:FB
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-VMC-Root-2024-RSA.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                Brand Indicator for Message Identification
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
            X509v3 Subject Key Identifier:
                B9:2C:B9:90:28:C0:CA:E2:B8:10:56:6E:E4:70:68:17:9D:54:73:BB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4B755C0495431F13FE25B455775264958541D5259E6ACB4226D490471CA7AE64
    SPKI SHA256: 73E0A4709C70A15D296C75D7105B8CF29874F2B8981F1FF035D85726C1DA9736
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Brand Indicator for Message Identification
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-VMC-Root-2024-RSA.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-VMC-Root-2024-RSA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Staclar Secure Identity CA R1

- Subject: countryName=US, organizationName=Staclar, Inc., commonName=Staclar Secure Identity CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com Client Certificate Enterprise Intermediate CA RSA R1
- Serial: 539A9DA15F3F6DA9ADA4C9572E6F3A59
- SHA-256: 6324FFD1A7207E4A5ABEE785C74A907D2B6A592B6FBB34BB3DB1DF413C833147
- SPKI SHA-256: EED6CA3CC65C66D415FF078AB4DFE041FDD93324CFE4A313B144D69A9762C52B
- Validity: 2023-04-24 to 2033-04-21
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crls.ssl.com/Staclar-SMIME-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:9a:9d:a1:5f:3f:6d:a9:ad:a4:c9:57:2e:6f:3a:59
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com Client Certificate Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Apr 24 19:43:56 2023 GMT
            Not After : Apr 21 19:43:55 2033 GMT
        Subject: C = US, O = "Staclar, Inc.", CN = Staclar Secure Identity CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                17:B6:0F:04:09:52:2A:F0:26:6F:F3:62:70:22:10:DD:B5:2B:F1:B2
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                7E:BA:0E:87:29:B0:56:AB:B3:45:A0:C5:38:DD:37:D0:15:C8:40:8A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6324FFD1A7207E4A5ABEE785C74A907D2B6A592B6FBB34BB3DB1DF413C833147
    SPKI SHA256: EED6CA3CC65C66D415FF078AB4DFE041FDD93324CFE4A313B144D69A9762C52B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-clientCert-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Staclar TLS Issuing CA R1

- Subject: countryName=US, stateOrProvinceName=Delaware, localityName=Claymont, organizationName=Staclar, Inc., commonName=Staclar TLS Issuing CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 29E0FB0EDE5C14376CA32A11A734504D
- SHA-256: FE6B6F9E44B670797D52E5F16EF1BB10B49EB3AD662522FC632B37DF9A5044CD
- SPKI SHA-256: DA1ACADB621109E41CD21BA108219348A6364742E6C9E154687E00AD147A6147
- Validity: 2021-06-23 to 2031-06-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Staclar-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:e0:fb:0e:de:5c:14:37:6c:a3:2a:11:a7:34:50:4d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Jun 23 16:38:47 2021 GMT
            Not After : Jun 21 16:38:46 2031 GMT
        Subject: C = US, ST = Delaware, L = Claymont, O = "Staclar, Inc.", CN = Staclar TLS Issuing CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                15:42:3B:58:0F:1E:AD:35:3C:E5:03:53:3C:99:77:79:EE:3C:06:96
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FE6B6F9E44B670797D52E5F16EF1BB10B49EB3AD662522FC632B37DF9A5044CD
    SPKI SHA256: DA1ACADB621109E41CD21BA108219348A6364742E6C9E154687E00AD147A6147
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Staclar TLS Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=Staclar TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 1322CB643322629DC8689D4111A75D0B
- SHA-256: 4F962D3AFD87926FAA1E44D1844DB21119ED4C66A57FB75B39528649678E72B3
- SPKI SHA-256: B0F0ECCCC6090A28DBDAE1A9A8639CD2FEC3071C2942670826C7F25688602941
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/Staclar-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:22:cb:64:33:22:62:9d:c8:68:9d:41:11:a7:5d:0b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 12:58:49 2026 GMT
            Not After : May 19 12:58:48 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = Staclar TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                23:DA:75:D8:BB:2D:68:F6:24:D3:C0:AC:D0:8C:C3:71:CF:0C:C1:75
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4F962D3AFD87926FAA1E44D1844DB21119ED4C66A57FB75B39528649678E72B3
    SPKI SHA256: B0F0ECCCC6090A28DBDAE1A9A8639CD2FEC3071C2942670826C7F25688602941
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissNS TLS Issuing RSA CA 2

- Subject: countryName=US, organizationName=SSL Corporation, commonName=SwissNS TLS Issuing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit RSA CA R2
- Serial: 699233EC1DB873D85F950A7007A0613A
- SHA-256: D9DF3D4EE098FD1DED8B51333D4B2A9D114E80F62C4CBDC2598E568BC5A46974
- SPKI SHA-256: D4268D40C5AAA21FE8A01E1178655FD5064286EF2963E8529F5D4D2B445E0EAB
- Validity: 2026-05-22 to 2036-05-19
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SwissNS-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:92:33:ec:1d:b8:73:d8:5f:95:0a:70:07:a0:61:3a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit RSA CA R2
        Validity
            Not Before: May 22 12:57:42 2026 GMT
            Not After : May 19 12:57:41 2036 GMT
        Subject: C = US, O = SSL Corporation, CN = SwissNS TLS Issuing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                21:41:34:63:8E:1D:91:0C:C3:DD:B6:24:B0:A8:87:7B:8D:65:60:08
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                71:F6:1A:96:13:EB:35:7F:6F:65:13:94:BA:AD:11:68:E9:E8:34:72
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D9DF3D4EE098FD1DED8B51333D4B2A9D114E80F62C4CBDC2598E568BC5A46974
    SPKI SHA256: D4268D40C5AAA21FE8A01E1178655FD5064286EF2963E8529F5D4D2B445E0EAB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissNS TLS Issuing RSA CA R1

- Subject: countryName=CH, stateOrProvinceName=Luzern, localityName=Luzern, organizationName=swissns GmbH, commonName=SwissNS TLS Issuing RSA CA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corp, commonName=SSL.com SSL Enterprise Intermediate CA RSA R1
- Serial: 42BF6CD1887BBEE8DEBD79801EA2D7D0
- SHA-256: 37FD29C701D6977998F205153EA8A4C2E996354DF072D4984DC5D8B1F75A2B61
- SPKI SHA-256: 28075AF8B245786B46B610AA09E8DEAF611402B15935EF9F9A590B76191D7097
- Validity: 2020-10-06 to 2030-10-04
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/SwissNS-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            42:bf:6c:d1:88:7b:be:e8:de:bd:79:80:1e:a2:d7:d0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corp, CN = SSL.com SSL Enterprise Intermediate CA RSA R1
        Validity
            Not Before: Oct  6 16:52:59 2020 GMT
            Not After : Oct  4 16:52:59 2030 GMT
        Subject: C = CH, ST = Luzern, L = Luzern, O = swissns GmbH, CN = SwissNS TLS Issuing RSA CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                D0:3D:EA:A2:98:07:5D:44:85:CF:03:FB:CA:BF:34:0A:9F:10:C4:68
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
            X509v3 Subject Key Identifier:
                8A:09:D9:47:51:E2:5C:0E:A8:BA:B1:90:D4:C0:59:F1:0B:DA:D5:0C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 37FD29C701D6977998F205153EA8A4C2E996354DF072D4984DC5D8B1F75A2B61
    SPKI SHA256: 28075AF8B245786B46B610AA09E8DEAF611402B15935EF9F9A590B76191D7097
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crt
- CRL Distribution Points: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-SSL-RSA-4096-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TLS ECC ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=TLS ECC ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority ECC
- Serial: 4FD2FAC80FC5A1B5E9E87E25286F5B81
- SHA-256: ED1FF4070F0868EB20A0319FC601919800F6E5EFD823A6156B27F89CB04B2C26
- SPKI SHA-256: C746FE9C6DC5BE6C185DCE21CA6515820AFEDF98235F31BE46DAAF5607632DA6
- Validity: 2019-12-05 to 2029-12-02
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-TLS-I-ECC-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:d2:fa:c8:0f:c5:a1:b5:e9:e8:7e:25:28:6f:5b:81
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority ECC
        Validity
            Not Before: Dec  5 17:52:43 2019 GMT
            Not After : Dec  2 17:52:43 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = TLS ECC ICA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                82:D1:85:73:30:E7:35:04:D3:8E:02:92:FB:E5:A4:D1:C4:21:E8:CD
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-ecc-RootCA.crl
            X509v3 Subject Key Identifier:
                DC:A7:25:B6:B7:EC:A5:50:F2:33:F6:67:D5:CC:A3:B7:57:DF:18:46
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: ED1FF4070F0868EB20A0319FC601919800F6E5EFD823A6156B27F89CB04B2C26
    SPKI SHA256: C746FE9C6DC5BE6C185DCE21CA6515820AFEDF98235F31BE46DAAF5607632DA6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcom-RootCA-ECC-384-R1.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-ecc-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TLS RSA ICA R1

- Subject: countryName=SC, stateOrProvinceName=Mahé, localityName=Victoria, organizationName=Public Key Infrastructure Ltd, commonName=TLS RSA ICA R1
- Issuer: countryName=US, stateOrProvinceName=Texas, localityName=Houston, organizationName=SSL Corporation, commonName=SSL.com Root Certification Authority RSA
- Serial: 08D3BB1C1D6C8C418C4C263837C1A17E
- SHA-256: 76AC5A7B74E310B9E624E7F7D118380CA9685B40C416C6B899E4A6D429BE7A3F
- SPKI SHA-256: 53D2DF8D3DADA7B0C89E339AC5964AACA5555749E3B6BBB251ECE32A523D1022
- Validity: 2019-12-05 to 2029-12-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.ca.pki.ltd/PKILtd-TLS-I-RSA-R1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:d3:bb:1c:1d:6c:8c:41:8c:4c:26:38:37:c1:a1:7e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
        Validity
            Not Before: Dec  5 17:41:11 2019 GMT
            Not After : Dec  2 17:41:11 2029 GMT
        Subject: C = SC, ST = Mah\C3\A9, L = Victoria, O = Public Key Infrastructure Ltd, CN = TLS RSA ICA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                DD:04:09:07:A2:F5:7A:7D:52:53:12:92:95:EE:38:80:25:0D:A6:59
            Authority Information Access:
                CA Issuers - URI:http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ssl.com-rsa-RootCA.crl
            X509v3 Subject Key Identifier:
                F4:AE:5A:8E:94:E6:1D:90:07:B5:7B:21:06:14:9E:BD:5D:E3:5A:3C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 76AC5A7B74E310B9E624E7F7D118380CA9685B40C416C6B899E4A6D429BE7A3F
    SPKI SHA256: 53D2DF8D3DADA7B0C89E339AC5964AACA5555749E3B6BBB251ECE32A523D1022
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
- CRL Distribution Points: http://crls.ssl.com/ssl.com-rsa-RootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustSafe TLS ECC SubCA 2

- Subject: countryName=US, organizationName=SSL Corp, commonName=TrustSafe TLS ECC SubCA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS ECC CA 2
- Serial: 54066C192CE77BEB09B405059B8D4011
- SHA-256: 86E7A398D1140FF32A3B14A67C55CAB5F097196ABBBD9241F31DBD2FD6CAA3BD
- SPKI SHA-256: 49A5D4B0A4B44B26CEB0A1549704B5EB67C619D302852AD326026B5C87E53805
- Validity: 2026-06-12 to 2036-06-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: https://crls.ssl.com/TrustSafe-TLS-I-E2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-E2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:06:6c:19:2c:e7:7b:eb:09:b4:05:05:9b:8d:40:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = E-Tugra TLS ECC CA 2
        Validity
            Not Before: Jun 12 19:23:51 2026 GMT
            Not After : Jun  9 16:50:26 2036 GMT
        Subject: C = US, O = SSL Corp, CN = TrustSafe TLS ECC SubCA 2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                BE:6F:D7:65:12:68:F1:38:48:29:59:7C:7E:A0:92:0B:55:02:7B:C9
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-E2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-E2.crl
            X509v3 Subject Key Identifier:
                5A:7C:3E:8D:31:0A:97:30:E8:E5:E5:CF:56:07:22:5D:EF:F8:B1:71
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 86E7A398D1140FF32A3B14A67C55CAB5F097196ABBBD9241F31DBD2FD6CAA3BD
    SPKI SHA256: 49A5D4B0A4B44B26CEB0A1549704B5EB67C619D302852AD326026B5C87E53805
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-E2.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-E2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### TrustSafe TLS ECC SubCA R1

- Subject: countryName=TR, organizationName=Isimtescil Bilisim A.S., commonName=TrustSafe TLS ECC SubCA R1
- Issuer: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS ECC CA R1
- Serial: 710DBF4661D9337ACB5622DFC277CAA7
- SHA-256: 5EAF05CFC9A017730D01E6688D6E39710E01FDE374E74B1B25D3A48076AE5DB8
- SPKI SHA-256: 48A8E9B65347CE012FC80AD5ADD4EEA7C3919065868A49B788598B248E194463
- Validity: 2022-03-04 to 2032-02-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/TrustSafe-TLS-I-ECC-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:0d:bf:46:61:d9:33:7a:cb:56:22:df:c2:77:ca:a7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS ECC CA R1
        Validity
            Not Before: Mar  4 17:56:31 2022 GMT
            Not After : Feb 26 21:31:00 2032 GMT
        Subject: C = TR, O = Isimtescil Bilisim A.S., CN = TrustSafe TLS ECC SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                70:52:6F:0E:78:6D:E2:F6:5C:E7:8A:E8:47:DD:60:70:2C:47:E4:CF
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-ECC-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
            X509v3 Subject Key Identifier:
                C1:F1:EC:D1:5C:A6:C9:A1:77:D1:D0:EC:4C:0C:60:E6:1B:CB:8B:9F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5EAF05CFC9A017730D01E6688D6E39710E01FDE374E74B1B25D3A48076AE5DB8
    SPKI SHA256: 48A8E9B65347CE012FC80AD5ADD4EEA7C3919065868A49B788598B248E194463
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-ECC-R1.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-ECC-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### TrustSafe TLS RSA SubCA 2

- Subject: countryName=US, organizationName=SSL Corp, commonName=TrustSafe TLS RSA SubCA 2
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=E-Tugra TLS RSA CA 2
- Serial: 1BBA02054559EF6AB94683C74547DFE3
- SHA-256: EA9B2113957C01E46182C41A5CC8018C6040F11DE62EB2BD689967AFB97626EE
- SPKI SHA-256: 0A1DBBDC37C08E627DC46B3844AFB3C5C58D999141747CE0085A4CD190D3ACD3
- Validity: 2026-06-12 to 2036-06-09
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/TrustSafe-TLS-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:ba:02:05:45:59:ef:6a:b9:46:83:c7:45:47:df:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = E-Tugra TLS RSA CA 2
        Validity
            Not Before: Jun 12 19:24:34 2026 GMT
            Not After : Jun  9 16:51:22 2036 GMT
        Subject: C = US, O = SSL Corp, CN = TrustSafe TLS RSA SubCA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                42:AD:BB:54:53:69:E7:13:2C:A4:4F:E4:75:F9:B5:1A:0B:96:B1:BE
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-R2.crl
            X509v3 Subject Key Identifier:
                3F:B5:F6:E6:01:3B:CB:AE:42:8B:D3:A0:42:FC:FA:A1:41:E2:59:15
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EA9B2113957C01E46182C41A5CC8018C6040F11DE62EB2BD689967AFB97626EE
    SPKI SHA256: 0A1DBBDC37C08E627DC46B3844AFB3C5C58D999141747CE0085A4CD190D3ACD3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-R2.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### TrustSafe TLS RSA SubCA R1

- Subject: countryName=TR, organizationName=Isimtescil Bilisim A.S., commonName=TrustSafe TLS RSA SubCA R1
- Issuer: countryName=TR, organizationName=E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, commonName=E-Tugra TLS RSA CA R1
- Serial: 4783866C574982F9D9EF8FADD7A05037
- SHA-256: 98A0C3BA1899258595D04F15D134C5732E864B755C648A48D1C17F0A260EF5A7
- SPKI SHA-256: FD2AD4198B16A435B8E2AFE020F2F87BEBCAAE82CFBB4FE7D0EC9266F6F983A5
- Validity: 2022-03-04 to 2032-02-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/TrustSafe-TLS-I-RSA-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:83:86:6c:57:49:82:f9:d9:ef:8f:ad:d7:a0:50:37
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = TR, O = E-TUGRA EBG BILISIM TEKNOLOJILERI VE HIZMETLERI ANONIM SIRKETI, CN = E-Tugra TLS RSA CA R1
        Validity
            Not Before: Mar  4 17:45:42 2022 GMT
            Not After : Feb 26 21:31:15 2032 GMT
        Subject: C = TR, O = Isimtescil Bilisim A.S., CN = TrustSafe TLS RSA SubCA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                44:6F:03:0D:B5:68:92:3C:AA:6D:D2:D3:61:F9:50:88:B8:1C:40:00
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/ETugra-TLS-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                34:D9:1B:EB:F8:97:E7:70:23:0F:8E:D8:77:0A:48:16:68:9F:CA:81
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 98A0C3BA1899258595D04F15D134C5732E864B755C648A48D1C17F0A260EF5A7
    SPKI SHA256: FD2AD4198B16A435B8E2AFE020F2F87BEBCAAE82CFBB4FE7D0EC9266F6F983A5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/ETugra-TLS-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/ETugra-TLS-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### Trustwave Client Authentication Certification Authority

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Client Authentication Certification Authority
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4190ACD5
- SHA-256: B98FD59783CEA8FE08AD61EC7AA91E5393138E72434E9F950001F95FEF10DF38
- SPKI SHA-256: DDD67DCD80D325A8E686E0C3DCBAD18109E5FFD11DAE708015A4507CBD425860
- Validity: 2009-06-24 to 2019-06-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.6.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1100000469 (0x4190acd5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jun 24 22:02:18 2009 GMT
            Not After : Jun 22 22:02:18 2019 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Client Authentication Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                1D:AC:7E:DF:53:9C:1B:74:CD:66:54:F4:80:19:63:C7:3C:D3:3F:CA
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.5.4.6.3
                  CPS: http://ssl.trustwave.com/CA/
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/XGCA.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B98FD59783CEA8FE08AD61EC7AA91E5393138E72434E9F950001F95FEF10DF38
    SPKI SHA256: DDD67DCD80D325A8E686E0C3DCBAD18109E5FFD11DAE708015A4507CBD425860
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.6.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Trustwave Client Authentication SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Client Authentication SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: C09E95442595A62E516826FF4C531CA6
- SHA-256: 7FE20CEEE2B6972D862542060AE9A88FEA5E43A977A7FB25C95246F7F76C0668
- SPKI SHA-256: 9AC4B8D9E93F7CA2995408C899347511CFAAB43CA53FDC76465A1CD8098A8DB1
- Validity: 2014-10-01 to 2024-09-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/CLACA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.6.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c0:9e:95:44:25:95:a6:2e:51:68:26:ff:4c:53:1c:a6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Oct  1 19:22:28 2014 GMT
            Not After : Sep 28 19:22:28 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Client Authentication SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4F:06:A1:99:A1:2A:23:EA:C6:3C:8A:86:73:8A:7C:5E:25:97:D2:2D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.5.4.6.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7FE20CEEE2B6972D862542060AE9A88FEA5E43A977A7FB25C95246F7F76C0668
    SPKI SHA256: 9AC4B8D9E93F7CA2995408C899347511CFAAB43CA53FDC76465A1CD8098A8DB1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.6.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Code Signing CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Code Signing CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4038B9AF
- SHA-256: 45CD9F38772BFA54F617BE02E2A1A8B9C3783395F187F8BCB723002CB9962836
- SPKI SHA-256: A754D6EC79686DD41B6EE9C8E77D06807D62293FA89E8CCD3D295A908484EB14
- Validity: 2008-05-07 to 2028-05-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.4.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1077459375 (0x4038b9af)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: May  7 18:08:33 2008 GMT
            Not After : May  7 18:08:33 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Code Signing CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                26:D4:9B:76:82:F7:D1:DD:90:55:F3:81:AC:A2:BA:9F:AE:23:30:FA
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.4.4.3.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 45CD9F38772BFA54F617BE02E2A1A8B9C3783395F187F8BCB723002CB9962836
    SPKI SHA256: A754D6EC79686DD41B6EE9C8E77D06807D62293FA89E8CCD3D295A908484EB14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.4.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Trustwave Code Signing CA, Level 2

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Code Signing CA, Level 2, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4190ABBB
- SHA-256: 95469A45EE12F3A7D1CA880A2F52442E2863593923FEC08AF6BCAB2375459E9B
- SPKI SHA-256: 16054612A81F5CC8C5A60F8672D8E00BE8C1E55DFC6C319BC2625B4D043D6115
- Validity: 2008-12-22 to 2028-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.3.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1100000187 (0x4190abbb)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Dec 22 23:47:40 2008 GMT
            Not After : Dec 22 23:47:40 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Code Signing CA, Level 2", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                DB:2C:7F:90:9B:A0:6F:C3:E5:9D:19:B6:64:41:23:F5:19:DD:9B:26
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/XGCA.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 1.3.6.1.4.1.30360.3.3.3.4.4.3.4
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 95469A45EE12F3A7D1CA880A2F52442E2863593923FEC08AF6BCAB2375459E9B
    SPKI SHA256: 16054612A81F5CC8C5A60F8672D8E00BE8C1E55DFC6C319BC2625B4D043D6115
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.3.4
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Trustwave Code Signing SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Code Signing SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: A423C004A9C770154230E5D271BE0654
- SHA-256: 53A8129F71A9827D03704670720C375061821155C076E86A490D6EB871E03AF0
- SPKI SHA-256: 40E83ECD9507DC0F908FDD4615308BCA06336CA66F744E73583CC4734A18AC76
- Validity: 2016-09-01 to 2024-09-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/CSCA2_L1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Sep  1 14:35:31 2016 GMT
            Not After : Sep 29 14:35:31 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Code Signing SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0C:F3:ED:A7:EC:9B:C1:4D:01:B1:B1:C2:9D:2B:A1:94:FE:38:46:B2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Subject Alternative Name:
                email:ca@trustwave.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 53A8129F71A9827D03704670720C375061821155C076E86A490D6EB871E03AF0
    SPKI SHA256: 40E83ECD9507DC0F908FDD4615308BCA06336CA66F744E73583CC4734A18AC76
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Domain Validation CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Domain Validation CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 4786F656
- SHA-256: 4613EC4B06B769CBB58DFE5492141D6AC07704823DE25F1072317C2D540B9272
- SPKI SHA-256: 31D3EF7213FD16C9EF9FBD9A209440B3E098D6A799DFAFFD831D4B60CCB2858A
- Validity: 2010-10-14 to 2028-12-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1200027222 (0x4786f656)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Oct 14 19:12:33 2010 GMT
            Not After : Dec 28 19:12:33 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Domain Validation CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                D2:98:AA:37:94:A7:60:AF:B4:0B:00:AB:09:A5:FE:82:22:55:9F:EC
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.5.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 4613EC4B06B769CBB58DFE5492141D6AC07704823DE25F1072317C2D540B9272
    SPKI SHA256: 31D3EF7213FD16C9EF9FBD9A209440B3E098D6A799DFAFFD831D4B60CCB2858A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.5.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp

### Trustwave Domain Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Domain Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 390A3F7EECA8FB4347DCAF701861662B
- SHA-256: 74F56E1AB339D83E80F2F6E264F894775B426C89B44703DF4FA8A3231163A2BD
- SPKI SHA-256: 0F6040FF019F45546DEAF01378B764349D01DDC915D869725080DD594A824834
- Validity: 2016-09-01 to 2024-09-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/DVCA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:0a:3f:7e:ec:a8:fb:43:47:dc:af:70:18:61:66:2b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Sep  1 14:35:32 2016 GMT
            Not After : Sep 29 14:35:32 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Domain Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:1C:E2:3A:AF:B6:A4:E4:D9:E9:9D:FE:EF:1C:77:A5:63:3D:EF:88
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Subject Alternative Name:
                email:ca@trustwave.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 74F56E1AB339D83E80F2F6E264F894775B426C89B44703DF4FA8A3231163A2BD
    SPKI SHA256: 0F6040FF019F45546DEAF01378B764349D01DDC915D869725080DD594A824834
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Domain Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Domain Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: DDEDF6F64298490E694C36EFA422C88F
- SHA-256: 859968F9278B4DC82EE30FD118A5D297D284B687CB64CF9755AB8A9D38F2B70F
- SPKI SHA-256: 0F6040FF019F45546DEAF01378B764349D01DDC915D869725080DD594A824834
- Validity: 2014-10-01 to 2024-09-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/DVCA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            dd:ed:f6:f6:42:98:49:0e:69:4c:36:ef:a4:22:c8:8f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Oct  1 19:22:32 2014 GMT
            Not After : Sep 28 19:22:32 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Domain Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F4:1C:E2:3A:AF:B6:A4:E4:D9:E9:9D:FE:EF:1C:77:A5:63:3D:EF:88
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.5.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 859968F9278B4DC82EE30FD118A5D297D284B687CB64CF9755AB8A9D38F2B70F
    SPKI SHA256: 0F6040FF019F45546DEAF01378B764349D01DDC915D869725080DD594A824834
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.5.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Enterprise CA

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise CA
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 2, emailAddress=ca@trustwave.com
- Serial: 6B49D204
- SHA-256: BBC9C7067DBDDBF77CFD1D18574D530BA97D0D86D5E861261BD02F9478C64FD7
- SPKI SHA-256: DFF37804A54592CD87B65E5FEF791B8EDE7C3D5EB04D72D00CB03F44C16278FF
- Validity: 2010-03-30 to 2029-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.6.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1800000004 (0x6b49d204)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Issuing CA, Level 2", emailAddress = ca@trustwave.com
        Validity
            Not Before: Mar 30 15:39:11 2010 GMT
            Not After : Dec 31 15:39:11 2029 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Enterprise CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                9F:33:F5:BC:90:6F:79:E0:CB:B9:E2:F3:D2:C0:D1:D8:F4:A6:DE:76
            X509v3 Authority Key Identifier:
                92:08:64:B1:BB:9F:A4:91:5B:5E:AF:53:ED:E2:92:F3:DB:66:AD:31
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.6.3
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BBC9C7067DBDDBF77CFD1D18574D530BA97D0D86D5E861261BD02F9478C64FD7
    SPKI SHA256: DFF37804A54592CD87B65E5FEF791B8EDE7C3D5EB04D72D00CB03F44C16278FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.6.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies

### Trustwave Enterprise CA

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise CA
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 2, emailAddress=ca@trustwave.com
- Serial: 6B49D204
- SHA-256: E186364C909BFCFF011B1D042F7AE1CCD45E92951D554AFE4BE3643FE751D19B
- SPKI SHA-256: DFF37804A54592CD87B65E5FEF791B8EDE7C3D5EB04D72D00CB03F44C16278FF
- Validity: 2010-04-09 to 2029-12-30
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.6.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.trustwave.com/ORGCA_L2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1800000004 (0x6b49d204)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Issuing CA, Level 2", emailAddress = ca@trustwave.com
        Validity
            Not Before: Apr  9 21:07:55 2010 GMT
            Not After : Dec 30 21:07:55 2029 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Enterprise CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier:
                9F:33:F5:BC:90:6F:79:E0:CB:B9:E2:F3:D2:C0:D1:D8:F4:A6:DE:76
            X509v3 Authority Key Identifier:
                92:08:64:B1:BB:9F:A4:91:5B:5E:AF:53:ED:E2:92:F3:DB:66:AD:31
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.6.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/ORGCA_L2.crl
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: E186364C909BFCFF011B1D042F7AE1CCD45E92951D554AFE4BE3643FE751D19B
    SPKI SHA256: DFF37804A54592CD87B65E5FEF791B8EDE7C3D5EB04D72D00CB03F44C16278FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.6.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/ORGCA_L2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp

### Trustwave Enterprise VPN CA

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise VPN CA
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Enterprise CA
- Serial: 4190AE5D
- SHA-256: C1CC86D9A7F5721D8A4C3C6B212B8DEB4FB446BFAD606E3B3DC92EA84FFA58EE
- SPKI SHA-256: 68C68B494BC276F4E0FC914BEB625EBA522A488A8D24F869E2537AF844679611
- Validity: 2010-03-30 to 2029-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.6.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1100000861 (0x4190ae5d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Enterprise CA
        Validity
            Not Before: Mar 30 15:40:25 2010 GMT
            Not After : Dec 31 15:40:25 2029 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Enterprise VPN CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F7:4A:43:64:D2:F7:FD:24:F6:3C:45:1A:55:06:C2:97:16:2A:20:4C
            X509v3 Authority Key Identifier:
                9F:33:F5:BC:90:6F:79:E0:CB:B9:E2:F3:D2:C0:D1:D8:F4:A6:DE:76
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.6.4.3.3
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C1CC86D9A7F5721D8A4C3C6B212B8DEB4FB446BFAD606E3B3DC92EA84FFA58EE
    SPKI SHA256: 68C68B494BC276F4E0FC914BEB625EBA522A488A8D24F869E2537AF844679611
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.6.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies

### Trustwave Extended Validation CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 3000494B
- SHA-256: 33D817B1B39FB28C3C348110EC210027F5629E08F4B9E55A41AA8D997996F03A
- SPKI SHA-256: FB8B68AD89C800B1EC9808F63C043EF9B3C9006FFC9F2AA4542541C9FE00E89C
- Validity: 2008-05-07 to 2028-05-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 805325131 (0x3000494b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: May  7 18:08:29 2008 GMT
            Not After : May  7 18:08:29 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Extended Validation CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                D9:3E:6A:11:91:9C:01:39:ED:5B:59:F0:F8:D5:9A:89:05:3B:FE:7C
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 33D817B1B39FB28C3C348110EC210027F5629E08F4B9E55A41AA8D997996F03A
    SPKI SHA256: FB8B68AD89C800B1EC9808F63C043EF9B3C9006FFC9F2AA4542541C9FE00E89C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Trustwave Extended Validation CA, Level 2

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation CA, Level 2, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 47869FE4
- SHA-256: 9B8231AC0A6AA25A68808EBD2D73FA0F81ABE66C2E530E312A4B2ED4F324CA32
- SPKI SHA-256: DF6BC09A166808BD50A10B10CE7119B16A7B6E7B619AE85433E1E5A2E985DFB4
- Validity: 2008-12-22 to 2028-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1200005092 (0x47869fe4)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Dec 22 23:47:37 2008 GMT
            Not After : Dec 22 23:47:37 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Extended Validation CA, Level 2", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                4C:19:16:E0:9A:EA:BE:48:94:4C:E1:87:DF:87:8B:4F:30:3B:EF:99
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/STCA.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9B8231AC0A6AA25A68808EBD2D73FA0F81ABE66C2E530E312A4B2ED4F324CA32
    SPKI SHA256: DF6BC09A166808BD50A10B10CE7119B16A7B6E7B619AE85433E1E5A2E985DFB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Trustwave Extended Validation CA, Level 3

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation CA, Level 3, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 47F8F6A8
- SHA-256: 129A59F7D25D63AE5BB90918F69EBF4178D7C820C1ED5E2F930EAE1F4C981DBB
- SPKI SHA-256: EADD7C8EFC91389301571A9622E9BC5C785AAF72D881A4BBB82497929E46CE29
- Validity: 2012-09-27 to 2027-09-24
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 2.16.840.1.114404.1.1.2.4.1, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1207498408 (0x47f8f6a8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Sep 27 18:42:19 2012 GMT
            Not After : Sep 24 18:42:19 2027 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Extended Validation CA, Level 3", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                6E:17:E0:AE:9B:63:26:A9:D7:4F:B1:C3:B9:78:0C:81:E6:CB:FF:8B
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 2.16.840.1.114404.1.1.2.4.1
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 129A59F7D25D63AE5BB90918F69EBF4178D7C820C1ED5E2F930EAE1F4C981DBB
    SPKI SHA256: EADD7C8EFC91389301571A9622E9BC5C785AAF72D881A4BBB82497929E46CE29
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 2.16.840.1.114404.1.1.2.4.1, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_key_usage_not_critical: 
- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Trustwave Extended Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 35962F305C5A0BEC400D4E9877528C65
- SHA-256: 49C58270F70F1BE0B7C19D1BC2C2EBC41E2FDE0D4885D4FA65EF0370ACEC7A00
- SPKI SHA-256: CC4F176018F761FEA75CD55D4EBCB4B57531E8B1AA21BC276F277BAC838AB9ED
- Validity: 2016-09-01 to 2024-09-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/EVCA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:96:2f:30:5c:5a:0b:ec:40:0d:4e:98:77:52:8c:65
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Sep  1 14:35:34 2016 GMT
            Not After : Sep 29 14:35:34 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Extended Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E5:E4:24:59:15:32:27:C9:20:B3:42:02:6C:B0:EF:32:DE:9B:20:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Subject Alternative Name:
                email:ca@trustwave.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 49C58270F70F1BE0B7C19D1BC2C2EBC41E2FDE0D4885D4FA65EF0370ACEC7A00
    SPKI SHA256: CC4F176018F761FEA75CD55D4EBCB4B57531E8B1AA21BC276F277BAC838AB9ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Extended Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: DCA0AC8B48276ADC2A5C92DCBB9ED3B5
- SHA-256: 9E8077AB54AED337540CF45AC72AE25FF1625C4D21542C13D129FB3381600B74
- SPKI SHA-256: CC4F176018F761FEA75CD55D4EBCB4B57531E8B1AA21BC276F277BAC838AB9ED
- Validity: 2014-10-01 to 2024-09-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            dc:a0:ac:8b:48:27:6a:dc:2a:5c:92:dc:bb:9e:d3:b5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Oct  1 19:22:34 2014 GMT
            Not After : Sep 28 19:22:34 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Extended Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E5:E4:24:59:15:32:27:C9:20:B3:42:02:6C:B0:EF:32:DE:9B:20:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9E8077AB54AED337540CF45AC72AE25FF1625C4D21542C13D129FB3381600B74
    SPKI SHA256: CC4F176018F761FEA75CD55D4EBCB4B57531E8B1AA21BC276F277BAC838AB9ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Extended Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Extended Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: C1BD27B383958D0D8BCA5E4F08D009D9
- SHA-256: EEA36C0FFA3F54FFDB0CF14B3BD34A53EC7B775F54053DD8B07DFD2F8BEC9083
- SPKI SHA-256: CC4F176018F761FEA75CD55D4EBCB4B57531E8B1AA21BC276F277BAC838AB9ED
- Validity: 2014-10-13 to 2024-10-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/EVCA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 2.16.840.1.114404.1.1.2.4.1, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c1:bd:27:b3:83:95:8d:0d:8b:ca:5e:4f:08:d0:09:d9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Oct 13 18:17:39 2014 GMT
            Not After : Oct 10 18:17:39 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Extended Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E5:E4:24:59:15:32:27:C9:20:B3:42:02:6C:B0:EF:32:DE:9B:20:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 2.16.840.1.114404.1.1.2.4.1
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EEA36C0FFA3F54FFDB0CF14B3BD34A53EC7B775F54053DD8B07DFD2F8BEC9083
    SPKI SHA256: CC4F176018F761FEA75CD55D4EBCB4B57531E8B1AA21BC276F277BAC838AB9ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 2.16.840.1.114404.1.1.2.4.1, 1.3.6.1.4.1.30360.3.3.3.3.4.3.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Global Certification Authority

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 07CE97C57A28C57B5C9FFC53FE69E8639DB872
- SHA-256: C6B3C6DE45BC8AB925536A1DF0BECDE9C422BE1A06BA39142758C1ECC558680E
- SPKI SHA-256: 2E06CAE1FC20B200E6FB748557A4444BEC9317DFFF2E4151669E0F7944F0A9E0
- Validity: 2025-03-03 to 2029-12-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGCA.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Any Extended Key Usage
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:97:c5:7a:28:c5:7b:5c:9f:fc:53:fe:69:e8:63:9d:b8:72
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Mar  3 10:38:44 2025 GMT
            Not After : Dec 17 16:38:44 2029 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Any Extended Key Usage
            X509v3 Subject Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/STCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C6B3C6DE45BC8AB925536A1DF0BECDE9C422BE1A06BA39142758C1ECC558680E
    SPKI SHA256: 2E06CAE1FC20B200E6FB748557A4444BEC9317DFFF2E4151669E0F7944F0A9E0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Any Extended Key Usage
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global Client CA, Level 1

- Subject: commonName=Trustwave Global Client CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 06CE82D9BA910474BB133B4AABCC6F607EB016
- SHA-256: 95811E24BEC41B5F2BCCCAFEEADA7711404EDF6604B8FF119C2E433500990BEB
- SPKI SHA-256: 921BDE8F9ED0DEB137AED199FDAEF081E40FA22F5F472451B05D17435036467E
- Validity: 2018-02-06 to 2028-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:ba:91:04:74:bb:13:3b:4a:ab:cc:6f:60:7e:b0:16
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb  6 12:21:22 2018 GMT
            Not After : Feb 24 05:01:22 2028 GMT
        Subject: CN = "Trustwave Global Client CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Key Identifier:
                81:E3:91:61:D1:E4:3F:40:EA:1D:76:25:BC:2B:F7:F7:9B:6C:5A:88
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 95811E24BEC41B5F2BCCCAFEEADA7711404EDF6604B8FF119C2E433500990BEB
    SPKI SHA256: 921BDE8F9ED0DEB137AED199FDAEF081E40FA22F5F472451B05D17435036467E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global Code Signing CA, Level 1

- Subject: commonName=Trustwave Global Code Signing CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 06CE82D9B3D498745605D6666B6D6D997BCB73
- SHA-256: 4D10A086866731C0E16174192114C6076C7995DD5493006DD2054EFBD169AE2B
- SPKI SHA-256: E3F79140CD0CE8C87F206F382846B3B780084D10835009F34984789137AC75BB
- Validity: 2018-02-06 to 2042-08-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGCSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:b3:d4:98:74:56:05:d6:66:6b:6d:6d:99:7b:cb:73
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Aug 21 18:21:21 2042 GMT
        Subject: CN = "Trustwave Global Code Signing CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                A8:DA:10:85:CF:EB:06:25:68:8D:C9:46:D5:FB:C0:B0:70:CC:6E:9B
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4D10A086866731C0E16174192114C6076C7995DD5493006DD2054EFBD169AE2B
    SPKI SHA256: E3F79140CD0CE8C87F206F382846B3B780084D10835009F34984789137AC75BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global Domain Validation CA, Level 1

- Subject: commonName=Trustwave Global Domain Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 06CE82D9AD30465CF22697F246B101EC92953B
- SHA-256: 6782C6E9ADBF9216E268306D46333FBC674BDEDF86B67BE777079E2C0E36888E
- SPKI SHA-256: 37C934C5036715D24166949743A5BD3A575A0D2279F57FA4150351ACD48DF02C
- Validity: 2018-02-06 to 2028-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGDVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:ad:30:46:5c:f2:26:97:f2:46:b1:01:ec:92:95:3b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Feb 24 05:01:21 2028 GMT
        Subject: CN = "Trustwave Global Domain Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                86:99:41:0C:CE:3F:B6:8C:70:49:E5:93:07:F0:86:07:1D:2D:7A:95
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6782C6E9ADBF9216E268306D46333FBC674BDEDF86B67BE777079E2C0E36888E
    SPKI SHA256: 37C934C5036715D24166949743A5BD3A575A0D2279F57FA4150351ACD48DF02C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-256 Client CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-256 Client CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 06CE82D9BCB00A2B3971F64A88F0CDC4736658
- SHA-256: D2BB9489EFACF48AD6B342D339C042953058E8F5DA4226ED3E76CA70C172E053
- SPKI SHA-256: 94E3B085363F6F4BEB8F76D951401B6486C4B670832509188626A89473C6BF0C
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:bc:b0:0a:2b:39:71:f6:4a:88:f0:cd:c4:73:66:58
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb  6 12:21:22 2018 GMT
            Not After : Feb 24 05:01:22 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-256 Client CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Key Identifier:
                02:88:3D:DD:A5:F6:97:31:EF:22:53:BD:DE:E2:93:42:C5:62:6F:B6
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: D2BB9489EFACF48AD6B342D339C042953058E8F5DA4226ED3E76CA70C172E053
    SPKI SHA256: 94E3B085363F6F4BEB8F76D951401B6486C4B670832509188626A89473C6BF0C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-256 Code Signing CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-256 Code Signing CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 06CE82D9B5F811DC86401B534E23C0674CDD2F
- SHA-256: 730E02CD3AFD489FDB9D708F674B45FA8CFD73AB926B94855B2C0376F9A528D9
- SPKI SHA-256: DE641CB9A2D87EE429BCB81AFCF4411D52A74024BEFDDAE34A9446C9A466CD0B
- Validity: 2018-02-06 to 2042-08-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2CSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:b5:f8:11:dc:86:40:1b:53:4e:23:c0:67:4c:dd:2f
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Aug 21 18:21:21 2042 GMT
        Subject: CN = "Trustwave Global ECDSA P-256 Code Signing CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                F8:4B:2D:3C:2F:C7:0F:82:28:F1:64:BD:01:40:34:27:F6:A1:C4:E6
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 730E02CD3AFD489FDB9D708F674B45FA8CFD73AB926B94855B2C0376F9A528D9
    SPKI SHA256: DE641CB9A2D87EE429BCB81AFCF4411D52A74024BEFDDAE34A9446C9A466CD0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-256 Domain Validation CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-256 Domain Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 06CE82D9AF531423847B85FB677932AAF80508
- SHA-256: F62E35AAD345FB253863CFC0E65823ACD3E7F0846D19B8326D709C7919A22D7E
- SPKI SHA-256: 6BEE4506565CC9D6302148A45B97D51FA32327355185D3DB6F9F3A8A634B6A01
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2DVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:af:53:14:23:84:7b:85:fb:67:79:32:aa:f8:05:08
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Feb 24 05:01:21 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-256 Domain Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0F:C3:50:61:99:7E:56:F5:C6:D9:9C:39:E8:83:58:90:07:BA:1A:B4
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: F62E35AAD345FB253863CFC0E65823ACD3E7F0846D19B8326D709C7919A22D7E
    SPKI SHA256: 6BEE4506565CC9D6302148A45B97D51FA32327355185D3DB6F9F3A8A634B6A01
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-256 Extended Validation CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-256 Extended Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 06CE82D9A20A3797CD878EB3DAA41D08680AF7
- SHA-256: 275BF0046E0270178B13B67E4DB150A10197CB71F9A061FAD36B3D76639FE186
- SPKI SHA-256: 633A60718C522839C4559DD3DE1DA86E1F56B08F48088B566C0AA1E12C82A6B0
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2EVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:a2:0a:37:97:cd:87:8e:b3:da:a4:1d:08:68:0a:f7
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb  6 12:21:20 2018 GMT
            Not After : Feb 24 05:01:20 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-256 Extended Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0C:25:56:AA:B3:62:06:A4:BF:EE:E0:1B:1B:57:CC:2F:2C:F6:0D:50
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 275BF0046E0270178B13B67E4DB150A10197CB71F9A061FAD36B3D76639FE186
    SPKI SHA256: 633A60718C522839C4559DD3DE1DA86E1F56B08F48088B566C0AA1E12C82A6B0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-256 Organization Validation CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-256 Organization Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 06CE82D9A8B57C104843994DACD79E28633E5F
- SHA-256: 18ABD6E9CA907BB36754D0C046EBB50DD9B95D527824D9581A31B750FCFDBAEF
- SPKI SHA-256: 95933037B0B075436A55D1142EE2F1A02B701080BDA868D658C7A520346D0CD5
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2OVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:a8:b5:7c:10:48:43:99:4d:ac:d7:9e:28:63:3e:5f
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Feb 24 05:01:21 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-256 Organization Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                AF:F8:9B:BC:5D:34:A5:DE:D0:3E:14:29:5D:0D:8E:25:AD:B0:A5:85
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 18ABD6E9CA907BB36754D0C046EBB50DD9B95D527824D9581A31B750FCFDBAEF
    SPKI SHA256: 95933037B0B075436A55D1142EE2F1A02B701080BDA868D658C7A520346D0CD5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-256 Timestamping CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-256 Timestamping CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 06CE82D9C3429711E7893F094ED7E918F7A662
- SHA-256: 7FC29B856B23EEFC3A5E68775E0B37DC320627FD5C19368BB68397EE219A667A
- SPKI SHA-256: 971295E6F44DDDE0FD3E636C42B85312E6D012A1495FD0531A628F3B1C7EAB53
- Validity: 2018-02-06 to 2042-08-21
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP2TSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:c3:42:97:11:e7:89:3f:09:4e:d7:e9:18:f7:a6:62
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb  6 12:21:22 2018 GMT
            Not After : Aug 21 18:21:22 2042 GMT
        Subject: CN = "Trustwave Global ECDSA P-256 Timestamping CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Subject Key Identifier:
                0B:32:69:F6:F0:D2:07:88:6A:1F:0F:67:B0:BF:45:58:C3:52:5A:3E
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 7FC29B856B23EEFC3A5E68775E0B37DC320627FD5C19368BB68397EE219A667A
    SPKI SHA256: 971295E6F44DDDE0FD3E636C42B85312E6D012A1495FD0531A628F3B1C7EAB53
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-384 Client CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-384 Client CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 06CE82D9BDD2207650BCF9DCAC40730AE5E94E
- SHA-256: 84C15D35B6E2F2F41E4A45E87BD3E96C1953A4FEEF196E425C8046650A75CE07
- SPKI SHA-256: 1FB1904E20FAC635D0AF0B02C7B3F143D93676C434C7AE6F3BFD3529CF3CDFF9
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:bd:d2:20:76:50:bc:f9:dc:ac:40:73:0a:e5:e9:4e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb  6 12:21:22 2018 GMT
            Not After : Feb 24 05:01:22 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-384 Client CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Subject Key Identifier:
                6C:9F:92:19:EA:36:24:0F:99:BA:2F:B2:99:D4:7D:FC:6E:D3:6D:6D
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 84C15D35B6E2F2F41E4A45E87BD3E96C1953A4FEEF196E425C8046650A75CE07
    SPKI SHA256: 1FB1904E20FAC635D0AF0B02C7B3F143D93676C434C7AE6F3BFD3529CF3CDFF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-384 Code Signing CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-384 Code Signing CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 06CE82D9B74015AF68CADF21F4FF77889E728E
- SHA-256: 7F2A890E8D9AFDB9C0F08AF1CB8DDA18C5802C5BEA50E0B18071D3CF973A46BD
- SPKI SHA-256: E14499391288EC00BE0E158E8688EC7B884785D2F9443C0E2460BBB4F8A24186
- Validity: 2018-02-06 to 2042-08-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3CSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:b7:40:15:af:68:ca:df:21:f4:ff:77:88:9e:72:8e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Aug 21 18:21:21 2042 GMT
        Subject: CN = "Trustwave Global ECDSA P-384 Code Signing CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                B0:E8:69:A1:8D:59:71:E8:2E:56:25:2B:EF:12:6A:AC:AA:A5:C7:36
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7F2A890E8D9AFDB9C0F08AF1CB8DDA18C5802C5BEA50E0B18071D3CF973A46BD
    SPKI SHA256: E14499391288EC00BE0E158E8688EC7B884785D2F9443C0E2460BBB4F8A24186
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-384 Domain Validation CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-384 Domain Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 06CE82D9B07A17CC5376157813389A2930A44A
- SHA-256: C63DF9618FBAF48662BA12ABE87B212CF777C27A446A0FA555D7A9D191148ED7
- SPKI SHA-256: 3486CD8B0EFD9518C25FB84029EEA861E3E38DA68043D97FCEF9B0A6D6230A08
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3DVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:b0:7a:17:cc:53:76:15:78:13:38:9a:29:30:a4:4a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Feb 24 05:01:21 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-384 Domain Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                A7:A7:AD:18:64:B5:BB:FA:06:18:47:C8:C0:9E:BC:65:FF:69:01:60
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C63DF9618FBAF48662BA12ABE87B212CF777C27A446A0FA555D7A9D191148ED7
    SPKI SHA256: 3486CD8B0EFD9518C25FB84029EEA861E3E38DA68043D97FCEF9B0A6D6230A08
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-384 Extended Validation CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-384 Extended Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 06CE82D9A331594530006781829387E40DBCB6
- SHA-256: 29F8E104DF38E612BF4F505365B5D0B0B20DD4E89C908306484EB8374C1E66D8
- SPKI SHA-256: 773B2C7EE9A98B7ADC25E9307D5354C84D7A4A8C52510E9245BBF7B9B8B6D621
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3EVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:a3:31:59:45:30:00:67:81:82:93:87:e4:0d:bc:b6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb  6 12:21:20 2018 GMT
            Not After : Feb 24 05:01:20 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-384 Extended Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                30:57:E2:B7:4F:60:6B:22:40:0A:43:5F:4F:FA:0D:CD:73:BC:24:27
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 29F8E104DF38E612BF4F505365B5D0B0B20DD4E89C908306484EB8374C1E66D8
    SPKI SHA256: 773B2C7EE9A98B7ADC25E9307D5354C84D7A4A8C52510E9245BBF7B9B8B6D621
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-384 Organization Validation CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-384 Organization Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 06CE82D9A9D8E29837EF90BEAF59DC6551BED6
- SHA-256: 87D42169B2693551CA205CCF17F06F6E6651F7218CD6D26607BF5BA4DD2F26F2
- SPKI SHA-256: F758B59A12B085CCF448AA09F42CCCFFDA2155A806E9C286F59FE2E13B351459
- Validity: 2018-02-06 to 2028-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3OVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:a9:d8:e2:98:37:ef:90:be:af:59:dc:65:51:be:d6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb  6 12:21:21 2018 GMT
            Not After : Feb 24 05:01:21 2028 GMT
        Subject: CN = "Trustwave Global ECDSA P-384 Organization Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                3A:17:C0:7E:62:3B:57:A0:B8:40:CA:CC:34:47:CD:96:7E:FC:09:88
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 87D42169B2693551CA205CCF17F06F6E6651F7218CD6D26607BF5BA4DD2F26F2
    SPKI SHA256: F758B59A12B085CCF448AA09F42CCCFFDA2155A806E9C286F59FE2E13B351459
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global ECDSA P-384 Timestamping CA, Level 1

- Subject: commonName=Trustwave Global ECDSA P-384 Timestamping CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 06CE82D9C46C4FDF94A159B12C1B6362D933CC
- SHA-256: F75E65420AD6C018D915BBBA40A77122B30ACFD417DA3A885E4C4CD9E065A415
- SPKI SHA-256: 56F812EEAE6F155FE64A115D87C90231455A25629A40228970F570608D7A62DF
- Validity: 2018-02-06 to 2042-08-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGP3TSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:c4:6c:4f:df:94:a1:59:b1:2c:1b:63:62:d9:33:cc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb  6 12:21:22 2018 GMT
            Not After : Aug 21 18:21:22 2042 GMT
        Subject: CN = "Trustwave Global ECDSA P-384 Timestamping CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Subject Key Identifier:
                15:F6:07:F2:7F:A3:B5:20:AB:60:22:91:2A:ED:28:F6:54:1F:8B:D2
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F75E65420AD6C018D915BBBA40A77122B30ACFD417DA3A885E4C4CD9E065A415
    SPKI SHA256: 56F812EEAE6F155FE64A115D87C90231455A25629A40228970F570608D7A62DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global Extended Validation CA, Level 1

- Subject: commonName=Trustwave Global Extended Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 06CE82D99FB3B180C281020314A2D1C7640017
- SHA-256: 18626A3B7211128D563469C654557D13C9366D7FCEC8B94DB4F0AA7E05944041
- SPKI SHA-256: 5777F5C467B32F4CD869126A02107348AB2F8F7BC4325A7D2860709D5E1B7B7F
- Validity: 2018-02-06 to 2028-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGEVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:9f:b3:b1:80:c2:81:02:03:14:a2:d1:c7:64:00:17
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb  6 12:21:20 2018 GMT
            Not After : Feb 24 05:01:20 2028 GMT
        Subject: CN = "Trustwave Global Extended Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                73:38:20:C6:47:6D:A6:C6:2F:7B:50:E0:40:DE:DE:C7:9D:47:DE:7C
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 18626A3B7211128D563469C654557D13C9366D7FCEC8B94DB4F0AA7E05944041
    SPKI SHA256: 5777F5C467B32F4CD869126A02107348AB2F8F7BC4325A7D2860709D5E1B7B7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global Organization Validation CA, Level 1

- Subject: commonName=Trustwave Global Organization Validation CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 06CE82D9A69703AEFE5D37D18858C74026B004
- SHA-256: 2E63DC1BECF427F9902B49DE6330FD3E8EEBF88B14E653B3BA2E37D4E4880965
- SPKI SHA-256: CF8AAB70F2FDE55417BA2060B1E2638F4C76B8A5E3E8D41C4F1B5C9E81961729
- Validity: 2018-02-06 to 2028-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGOVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:a6:97:03:ae:fe:5d:37:d1:88:58:c7:40:26:b0:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb  6 12:21:20 2018 GMT
            Not After : Feb 24 05:01:20 2028 GMT
        Subject: CN = "Trustwave Global Organization Validation CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                B7:FD:53:73:38:26:8A:70:AB:93:CA:8B:A9:08:EA:C7:D3:B7:E3:FD
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E63DC1BECF427F9902B49DE6330FD3E8EEBF88B14E653B3BA2E37D4E4880965
    SPKI SHA256: CF8AAB70F2FDE55417BA2060B1E2638F4C76B8A5E3E8D41C4F1B5C9E81961729
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Global Timestamping CA, Level 1

- Subject: commonName=Trustwave Global Timestamping CA, Level 1, organizationName=Trustwave Holdings, Inc., localityName=Chicago, stateOrProvinceName=Illinois, countryName=US
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 06CE82D9C1216EDC01C3D47984D71A3C258C83
- SHA-256: 643B81C90B3505BFAFF80EAAC9EE28C9F406362A8F56DD26ECFA29335958C856
- SPKI SHA-256: E3F59027DB3CF287CFD699525AE376DAB9B07DD8A5CF092C5D99A777A66E3EF3
- Validity: 2018-02-06 to 2042-08-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TWGTSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com/
- CRL DP: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:ce:82:d9:c1:21:6e:dc:01:c3:d4:79:84:d7:1a:3c:25:8c:83
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb  6 12:21:22 2018 GMT
            Not After : Aug 21 18:21:22 2042 GMT
        Subject: CN = "Trustwave Global Timestamping CA, Level 1", O = "Trustwave Holdings, Inc.", L = Chicago, ST = Illinois, C = US
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Subject Key Identifier:
                3E:32:C5:BF:01:31:8C:20:ED:8E:F5:80:31:BF:79:FA:9A:33:0C:67
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com/
                CA Issuers - URI:http://ssl.trustwave.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 643B81C90B3505BFAFF80EAAC9EE28C9F406362A8F56DD26ECFA29335958C856
    SPKI SHA256: E3F59027DB3CF287CFD699525AE376DAB9B07DD8A5CF092C5D99A777A66E3EF3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com/
- AIA CA Issuers: http://ssl.trustwave.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave Organization Issuing CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4038B9B0
- SHA-256: BF95FE5B4EF85F4501B9AB15DFA119F6DD56ADA41CDAB7A3FF2EDE4893C9AC67
- SPKI SHA-256: 08AD499E72119A7E65A2E301CE0CC08D14511C4B03B252AE87F68BA5BA4B17C0
- Validity: 2008-05-07 to 2028-05-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.4.4.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1077459376 (0x4038b9b0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: May  7 18:08:34 2008 GMT
            Not After : May  7 18:08:34 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Issuing CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                8F:46:27:A2:75:81:5C:8E:DE:56:67:AC:59:20:B5:64:45:3A:74:45
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.4.4.4.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BF95FE5B4EF85F4501B9AB15DFA119F6DD56ADA41CDAB7A3FF2EDE4893C9AC67
    SPKI SHA256: 08AD499E72119A7E65A2E301CE0CC08D14511C4B03B252AE87F68BA5BA4B17C0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.4.4.4.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Trustwave Organization Issuing CA, Level 2

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Issuing CA, Level 2, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4190ABBC
- SHA-256: 77DECE8000964A74AEED685C0C9301F081A29B6F1803B14230DBD0BAC7A39CFC
- SPKI SHA-256: 482725129C5C33C4374184B8D0E686209E1883A8ADCBBCC6BBD4674677609CE9
- Validity: 2008-12-22 to 2028-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1100000188 (0x4190abbc)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Dec 22 23:47:42 2008 GMT
            Not After : Dec 22 23:47:42 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Issuing CA, Level 2", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                92:08:64:B1:BB:9F:A4:91:5B:5E:AF:53:ED:E2:92:F3:DB:66:AD:31
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/XGCA.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 1.3.6.1.4.1.30360.3.3.3.4.4.4.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 77DECE8000964A74AEED685C0C9301F081A29B6F1803B14230DBD0BAC7A39CFC
    SPKI SHA256: 482725129C5C33C4374184B8D0E686209E1883A8ADCBBCC6BBD4674677609CE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.4.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Trustwave Organization Validation CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 3000494C
- SHA-256: 0EA48A31DD8399CACCE5B69029F537902A7985703F115C9CB9F8C9896C42245C
- SPKI SHA-256: 768C1CED29BEC12790405C803050BAEE1ED177BD5D63B2867DE88FF014C9CEF4
- Validity: 2008-05-07 to 2028-05-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 805325132 (0x3000494c)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: May  7 18:08:31 2008 GMT
            Not After : May  7 18:08:31 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Validation CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                02:B4:26:79:E1:22:45:41:60:90:85:43:BA:AA:65:27:C4:94:F5:32
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0EA48A31DD8399CACCE5B69029F537902A7985703F115C9CB9F8C9896C42245C
    SPKI SHA256: 768C1CED29BEC12790405C803050BAEE1ED177BD5D63B2867DE88FF014C9CEF4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Trustwave Organization Validation CA, Level 2

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation CA, Level 2, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 47869FE5
- SHA-256: 6B561306226D6E7E81F64FFA43E56CA98C9B95E71B4459D87CE2D2F7259E457B
- SPKI SHA-256: 0D2B546C112EA823C3372A727C6F4FF76AB28D1E47CD02828322BC02D39F3DDE
- Validity: 2008-12-22 to 2028-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1200005093 (0x47869fe5)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Dec 22 23:47:39 2008 GMT
            Not After : Dec 22 23:47:39 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Validation CA, Level 2", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                5D:D9:96:9A:40:C7:27:CB:2C:9B:A2:EC:CF:19:AB:C8:AF:CC:86:48
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/STCA.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6B561306226D6E7E81F64FFA43E56CA98C9B95E71B4459D87CE2D2F7259E457B
    SPKI SHA256: 0D2B546C112EA823C3372A727C6F4FF76AB28D1E47CD02828322BC02D39F3DDE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Trustwave Organization Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 4B2C6646F434775B67DF34A04DD504E6
- SHA-256: FF1E0D233196B7EC20BEDFC65988E0AE1985EC6AC332A79ADFFE71B86BC0208A
- SPKI SHA-256: 392AA721122125018A12D73B69B64CA52E18DDD8E1DFDA29CEA2365AA95856A3
- Validity: 2014-10-01 to 2024-09-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/OVCA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4b:2c:66:46:f4:34:77:5b:67:df:34:a0:4d:d5:04:e6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Oct  1 19:22:36 2014 GMT
            Not After : Sep 28 19:22:36 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CA:CE:1D:18:03:77:1E:1C:F3:7C:58:B2:9A:70:A8:08:80:16:F4:AE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FF1E0D233196B7EC20BEDFC65988E0AE1985EC6AC332A79ADFFE71B86BC0208A
    SPKI SHA256: 392AA721122125018A12D73B69B64CA52E18DDD8E1DFDA29CEA2365AA95856A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.4.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Organization Validation SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Organization Validation SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 92B8744F71CED0E26C72A3D8D5D925B2
- SHA-256: 58EA0688B7909AAA8EAAA2FFF36F3BBE8F4A2AD03BD70243B3903469DB4890F7
- SPKI SHA-256: 392AA721122125018A12D73B69B64CA52E18DDD8E1DFDA29CEA2365AA95856A3
- Validity: 2016-09-01 to 2024-09-29
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/OVCA2_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            92:b8:74:4f:71:ce:d0:e2:6c:72:a3:d8:d5:d9:25:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Sep  1 14:35:35 2016 GMT
            Not After : Sep 29 14:35:35 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Organization Validation SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CA:CE:1D:18:03:77:1E:1C:F3:7C:58:B2:9A:70:A8:08:80:16:F4:AE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/STCA.crl
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/STCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Subject Alternative Name:
                email:ca@trustwave.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 58EA0688B7909AAA8EAAA2FFF36F3BBE8F4A2AD03BD70243B3903469DB4890F7
    SPKI SHA256: 392AA721122125018A12D73B69B64CA52E18DDD8E1DFDA29CEA2365AA95856A3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/STCA.crt
- CRL Distribution Points: http://crl.trustwave.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ext_san_rfc822_name_present: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave S/MIME CA, Level 2

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave S/MIME CA, Level 2, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Serial: 4D7C6D01
- SHA-256: 0A2A1C448F468DD197E9E8CC70C72AB0BDCA976CE56F6B3221F366250A3FB150
- SPKI SHA-256: BDABF66F8A26D67462E562A8FC65877DE212553A49AD2408BC9373B828FBBEB3
- Validity: 2008-12-22 to 2028-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1300000001 (0x4d7c6d01)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Validity
            Not Before: Dec 22 23:47:45 2008 GMT
            Not After : Dec 22 23:47:45 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave S/MIME CA, Level 2", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                0B:A3:DF:1C:44:F8:F8:62:63:8E:B9:94:7C:E3:61:6F:23:50:14:79
            X509v3 Authority Key Identifier:
                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/SGCA.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0A2A1C448F468DD197E9E8CC70C72AB0BDCA976CE56F6B3221F366250A3FB150
    SPKI SHA256: BDABF66F8A26D67462E562A8FC65877DE212553A49AD2408BC9373B828FBBEB3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Trustwave S/MIME SHA256 CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave S/MIME SHA256 CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 3A83B71EE02C3CCA1CE1A2643E9B66EA
- SHA-256: 5C4BC597291AB9C7023FB6445FD60381A65C60DDD404F124E5FA143FE98B05F3
- SPKI SHA-256: D338B2A591AD6D04A52647776CEEAC6BAE0069EBFF17D0CC5E85AB7483CCBA27
- Validity: 2014-10-01 to 2024-09-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/SMCA2_L1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3a:83:b7:1e:e0:2c:3c:ca:1c:e1:a2:64:3e:9b:66:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Oct  1 19:22:38 2014 GMT
            Not After : Sep 28 19:22:38 2024 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave S/MIME SHA256 CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0C:33:A3:57:AA:E3:AB:D6:4B:70:1B:36:9E:A3:ED:61:50:E6:AF:74
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/XGCA.crt
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5C4BC597291AB9C7023FB6445FD60381A65C60DDD404F124E5FA143FE98B05F3
    SPKI SHA256: D338B2A591AD6D04A52647776CEEAC6BAE0069EBFF17D0CC5E85AB7483CCBA27
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Secure E-mail CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Secure E-mail CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Serial: 40002711
- SHA-256: FF9EBCE9694BAF4F2F53239AB13ACC3C63C004C2B4CAFD3D752492D3A429BA12
- SPKI SHA-256: F5D49F0EEFFE9B8A6910DDFA169F99F195366E1A7237FD8C48F5F060915E19E5
- Validity: 2008-05-07 to 2028-05-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1073751825 (0x40002711)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Validity
            Not Before: May  7 18:08:38 2008 GMT
            Not After : May  7 18:08:38 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Secure E-mail CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                6C:8A:0B:92:4A:1C:EC:40:63:05:6D:72:5E:81:38:B4:A3:36:12:11
            X509v3 Authority Key Identifier:
                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FF9EBCE9694BAF4F2F53239AB13ACC3C63C004C2B4CAFD3D752492D3A429BA12
    SPKI SHA256: F5D49F0EEFFE9B8A6910DDFA169F99F195366E1A7237FD8C48F5F060915E19E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.5.4.3.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Trustwave Secure Global Extended Validation CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Secure Global Extended Validation CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Serial: F6F61CE4A3635BB0CA8AACEEFCB2D0F0
- SHA-256: 45B2B08E1B58948A028BE13A67C0E20D4B2466AE2B6EC6250EBB10FD6B7F8239
- SPKI SHA-256: 8F23E85F92E708CBA47EF171AF1B89594AD9C9CA7AF4C99DA615E24EB869314E
- Validity: 2015-08-12 to 2025-08-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/SGEVCA_L1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f6:f6:1c:e4:a3:63:5b:b0:ca:8a:ac:ee:fc:b2:d0:f0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Validity
            Not Before: Aug 12 20:17:29 2015 GMT
            Not After : Aug  9 20:17:29 2025 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Secure Global Extended Validation CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C7:7D:EA:5D:19:AB:54:D4:FA:3F:E6:4A:73:DE:7A:B2:3C:1D:6C:2E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/SGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/SGCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 45B2B08E1B58948A028BE13A67C0E20D4B2466AE2B6EC6250EBB10FD6B7F8239
    SPKI SHA256: 8F23E85F92E708CBA47EF171AF1B89594AD9C9CA7AF4C99DA615E24EB869314E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/SGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Trustwave Special Use CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Special Use CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4038B9B1
- SHA-256: B8189A970EF7B6D87071634E052C0E1FFD1C71B17DD938D4D78DB4D5FB656345
- SPKI SHA-256: BE98717C2FD0D2B16774FAFC33AC884B516E6FFA4FD6C64B2507057C7FF26574
- Validity: 2008-05-07 to 2028-05-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.4.4.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1077459377 (0x4038b9b1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: May  7 18:08:36 2008 GMT
            Not After : May  7 18:08:36 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Special Use CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                ED:B3:37:A6:6A:46:81:32:33:C8:25:B9:02:8B:E0:4C:5E:3A:75:AF
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.4.4.5.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B8189A970EF7B6D87071634E052C0E1FFD1C71B17DD938D4D78DB4D5FB656345
    SPKI SHA256: BE98717C2FD0D2B16774FAFC33AC884B516E6FFA4FD6C64B2507057C7FF26574
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.4.4.5.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### Trustwave Special Use CA, Level 2

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Special Use CA, Level 2, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 4190ABBD
- SHA-256: B67F5D33425589714F4E16580D9D090165440AA46FEDBC910E4B41774E818E52
- SPKI SHA-256: FC336F19AD0F0C298241F8B47D8869A5026E0B000F05FE3A78C568F60825CAA4
- Validity: 2008-12-22 to 2028-12-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.5.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1100000189 (0x4190abbd)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Dec 22 23:47:44 2008 GMT
            Not After : Dec 22 23:47:44 2028 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Special Use CA, Level 2", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                46:DF:2C:CA:F7:C3:7A:23:B2:AF:4F:BA:3E:A2:8D:AD:29:9A:A7:DD
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.securetrust.com/XGCA.crl
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.0
                Policy: 1.3.6.1.4.1.30360.3.3.3.4.4.5.3
                  CPS: http://www.securetrust.com/legal/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B67F5D33425589714F4E16580D9D090165440AA46FEDBC910E4B41774E818E52
    SPKI SHA256: FC336F19AD0F0C298241F8B47D8869A5026E0B000F05FE3A78C568F60825CAA4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.30360.3.0, 1.3.6.1.4.1.30360.3.3.3.4.4.5.3
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.securetrust.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp

### Trustwave Timestamping CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Timestamping CA, Level 1
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 29DC9D198E5320CCAB80443063BAFA1C
- SHA-256: EF5AE8BBF214337779B8A30730962638BB3AFE100C615A49730F709A2518861B
- SPKI SHA-256: DF7C3F1286E76414D2B516278217D3B3259F5372090004350A53B90E811975C1
- Validity: 2017-01-25 to 2034-12-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/TSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.8.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:dc:9d:19:8e:53:20:cc:ab:80:44:30:63:ba:fa:1c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jan 25 16:21:44 2017 GMT
            Not After : Dec 25 16:21:44 2034 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave Timestamping CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                37:D1:D4:5F:24:54:68:D3:F0:9C:12:CA:4D:F6:33:C5:31:BD:04:05
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.30360.3.3.3.3.4.8.3
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/XGCA.crt
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EF5AE8BBF214337779B8A30730962638BB3AFE100C615A49730F709A2518861B
    SPKI SHA256: DF7C3F1286E76414D2B516278217D3B3259F5372090004350A53B90E811975C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.3.6.1.4.1.30360.3.3.3.3.4.8.3
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trustwave XRamp Global Extended Validation CA, Level 1

- Subject: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave XRamp Global Extended Validation CA, Level 1, emailAddress=ca@trustwave.com
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: D3D519C2B2EB5C7040F64CBC957BBD2C
- SHA-256: 1D0CD7EF3C19265508E20E58B3538964F4A11ADEC8A71D8AB8A8AFF15683C6AE
- SPKI SHA-256: 6CD2A5B92E0FBB78A3675A68961B4724F7C1D870F9B11FECE3A8743587A2AFA5
- Validity: 2015-08-12 to 2025-08-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/XGEVCA_L1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trustwave.com
- CRL DP: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d3:d5:19:c2:b2:eb:5c:70:40:f6:4c:bc:95:7b:bd:2c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Aug 12 20:17:31 2015 GMT
            Not After : Aug  9 20:17:31 2025 GMT
        Subject: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = "Trustwave XRamp Global Extended Validation CA, Level 1", emailAddress = ca@trustwave.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C5:CE:B9:3B:42:45:C0:CD:09:E5:68:E8:48:3A:83:5D:6C:8E:AB:18
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://ssl.trustwave.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.trustwave.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trustwave.com
                CA Issuers - URI:http://ssl.trustwave.com/issuers/XGCA.crt
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1D0CD7EF3C19265508E20E58B3538964F4A11ADEC8A71D8AB8A8AFF15683C6AE
    SPKI SHA256: 6CD2A5B92E0FBB78A3675A68961B4724F7C1D870F9B11FECE3A8743587A2AFA5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trustwave.com
- AIA CA Issuers: http://ssl.trustwave.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.trustwave.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Viking Cloud Client Authentication CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Client Authentication CA, Level 1
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 076B9C83A942C04F85871B483FC408379499EC
- SHA-256: 115B4CCB4B7A8D2733085363311A3EE5A2603A4198483814E727181F0D45BB89
- SPKI SHA-256: A0A23A42D59EEED4F363D877AA2DD9FFFED79EC0277651A670BB84F63C14628F
- Validity: 2022-06-09 to 2029-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCCLCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:6b:9c:83:a9:42:c0:4f:85:87:1b:48:3f:c4:08:37:94:99:ec
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jun  9 11:15:00 2022 GMT
            Not After : Dec 15 17:15:00 2029 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud Client Authentication CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                D1:4E:11:60:CA:E4:D0:04:53:24:37:DB:8D:81:03:A6:48:2D:99:44
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 115B4CCB4B7A8D2733085363311A3EE5A2603A4198483814E727181F0D45BB89
    SPKI SHA256: A0A23A42D59EEED4F363D877AA2DD9FFFED79EC0277651A670BB84F63C14628F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Viking Cloud Domain Validation CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Domain Validation CA, Level 1
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 076B9C83A6F816DB07DE81EF75D6BAF8EA803D
- SHA-256: 386AD965DA24812016ED3F011F2112DFD591693DABEB3D0E61B1145F5F9D1217
- SPKI SHA-256: 8EE9C778A35359FA5BCFDDD65522CDFD7783A7E0C4664252A8CCEDD345F16010
- Validity: 2022-06-09 to 2029-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCDVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:6b:9c:83:a6:f8:16:db:07:de:81:ef:75:d6:ba:f8:ea:80:3d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jun  9 11:15:00 2022 GMT
            Not After : Dec 15 17:15:00 2029 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud Domain Validation CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                03:36:A9:26:DE:08:13:D9:36:70:F0:58:1E:AF:81:4D:CF:A9:D0:BE
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 386AD965DA24812016ED3F011F2112DFD591693DABEB3D0E61B1145F5F9D1217
    SPKI SHA256: 8EE9C778A35359FA5BCFDDD65522CDFD7783A7E0C4664252A8CCEDD345F16010
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Viking Cloud Extended Validation CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Extended Validation CA, Level 1
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 076B9C83A240FE8AB30D8E895D1F447D16990E
- SHA-256: 10B608E53E0F3F44432A32B906CD753001736AC8BFE90ED3A0847DF285E2D977
- SPKI SHA-256: 89A5F717F0C1C6D788BD9298A1351705DFF66D55C638D98891A7868D534F476C
- Validity: 2022-06-09 to 2029-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCEVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:6b:9c:83:a2:40:fe:8a:b3:0d:8e:89:5d:1f:44:7d:16:99:0e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jun  9 11:14:59 2022 GMT
            Not After : Dec 15 17:14:59 2029 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud Extended Validation CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                32:81:57:10:07:8B:4D:B7:A6:C6:2C:93:6C:EE:AD:AE:2D:0E:DE:40
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 10B608E53E0F3F44432A32B906CD753001736AC8BFE90ED3A0847DF285E2D977
    SPKI SHA256: 89A5F717F0C1C6D788BD9298A1351705DFF66D55C638D98891A7868D534F476C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Viking Cloud Organization Validation CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Organization Validation CA, Level 1
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=SecureTrust CA
- Serial: 076B9C83A4ACA8AF581CBEF232CAD142A73519
- SHA-256: 0EEF05BDA7842EA85D1D9812495EFC561283BAA90D1431C579DD61F7ED9269A1
- SPKI SHA-256: BA72CC8FF40135EFD0EEDA3E788726DC324082B3283D63E413015932C6D163B9
- Validity: 2022-06-09 to 2029-12-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCOVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:6b:9c:83:a4:ac:a8:af:58:1c:be:f2:32:ca:d1:42:a7:35:19
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = SecureTrust CA
        Validity
            Not Before: Jun  9 11:15:00 2022 GMT
            Not After : Dec 15 17:15:00 2029 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud Organization Validation CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                84:F7:19:CE:7B:40:54:50:42:4E:0C:D2:32:50:DC:7A:2F:72:56:6C
            X509v3 Authority Key Identifier:
                42:32:B6:16:FA:04:FD:FE:5D:4B:7A:C3:FD:F7:4C:40:1D:5A:43:AF
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/STCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0EEF05BDA7842EA85D1D9812495EFC561283BAA90D1431C579DD61F7ED9269A1
    SPKI SHA256: BA72CC8FF40135EFD0EEDA3E788726DC324082B3283D63E413015932C6D163B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.vikingcloud.com/STCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Viking Cloud Secure Email CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud Secure Email CA, Level 1
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 076B9C83AB8B5B567585DDA84832D1425F3EE3
- SHA-256: 84071B259D851367E653E0E477A9ECDCA3F10453E1FE57A1EA5728F7934824C9
- SPKI SHA-256: E4D6BBB65C92352B4D3A4AB5DE3B5561BDB239A98A2543BB3BFBF932D97C0FC8
- Validity: 2022-06-09 to 2032-06-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCSMCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:6b:9c:83:ab:8b:5b:56:75:85:dd:a8:48:32:d1:42:5f:3e:e3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Jun  9 11:15:00 2022 GMT
            Not After : Jun  9 11:15:00 2032 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud Secure Email CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                55:8D:14:89:0F:BC:18:AA:83:44:AD:6C:3F:A4:9E:C4:54:3F:5A:69
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 84071B259D851367E653E0E477A9ECDCA3F10453E1FE57A1EA5728F7934824C9
    SPKI SHA256: E4D6BBB65C92352B4D3A4AB5DE3B5561BDB239A98A2543BB3BFBF932D97C0FC8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.vikingcloud.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### Viking Cloud TWG Code Signing CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud TWG Code Signing CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 0771C1BCFFF4F58834C234041D249B26460192
- SHA-256: E7EADE07201F519CC43A51D3F33D4EC3112D5A72D83EFB4104CBC1B306DAB762
- SPKI SHA-256: 7F5E732653A17C077E4AF1AC67EE2349AB4E5A51A36624E5CF35C41AD7DED7C7
- Validity: 2022-08-10 to 2032-08-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGCSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:71:c1:bc:ff:f4:f5:88:34:c2:34:04:1d:24:9b:26:46:01:92
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Aug 10 10:18:24 2022 GMT
            Not After : Aug 10 10:18:24 2032 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud TWG Code Signing CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                4B:E9:22:81:5E:FF:53:2A:F8:20:BF:9B:48:DD:9A:59:02:29:1B:F9
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E7EADE07201F519CC43A51D3F33D4EC3112D5A72D83EFB4104CBC1B306DAB762
    SPKI SHA256: 7F5E732653A17C077E4AF1AC67EE2349AB4E5A51A36624E5CF35C41AD7DED7C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Viking Cloud TWG Timestamping CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=Viking Cloud TWG Timestamping CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 0771C1BCFC085F97F18C6A6A23C8D37F087DF9
- SHA-256: FA623A8BA0D6C69590593A62A67484EACCD1D3A7B19DCA78139DC3E30AC0B68A
- SPKI SHA-256: D9A73E4E8C91B1BF801001C1B223166F40B7092ABD94F808411B5C0213446DF9
- Validity: 2022-08-10 to 2037-08-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGTSCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:71:c1:bc:fc:08:5f:97:f1:8c:6a:6a:23:c8:d3:7f:08:7d:f9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Aug 10 10:18:23 2022 GMT
            Not After : Aug 10 10:18:23 2037 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "Viking Cloud TWG Timestamping CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Subject Key Identifier:
                DC:CA:F2:5D:69:68:74:88:4E:34:A8:45:3D:6F:62:DB:24:24:D8:A9
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FA623A8BA0D6C69590593A62A67484EACCD1D3A7B19DCA78139DC3E30AC0B68A
    SPKI SHA256: D9A73E4E8C91B1BF801001C1B223166F40B7092ABD94F808411B5C0213446DF9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud SG TLS EV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud SG TLS EV CA, Level 1
- Issuer: countryName=US, organizationName=SecureTrust Corporation, commonName=Secure Global CA
- Serial: 07CE18ED0BD129A5CF75507E9AC79366260CB1
- SHA-256: 93BFF79125F03F32BA57A6F1E5EFAF5705D278A72C057B2A6C66E1F103ABA517
- SPKI SHA-256: 21C612BE6A6B8DED1559F12515DE92505769E0335BF8C09A1AE38165BFF62804
- Validity: 2025-02-26 to 2029-12-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCSGEVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:0b:d1:29:a5:cf:75:50:7e:9a:c7:93:66:26:0c:b1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SecureTrust Corporation, CN = Secure Global CA
        Validity
            Not Before: Feb 26 10:44:51 2025 GMT
            Not After : Dec 22 16:44:51 2029 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud SG TLS EV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                CA:0E:89:9A:01:AB:EA:49:A5:15:B9:2B:90:C6:86:E4:D7:41:44:80
            X509v3 Authority Key Identifier:
                AF:44:04:C2:41:7E:48:83:DB:4E:39:02:EC:EC:84:7A:E6:CE:C9:A4
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/SGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/SGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 93BFF79125F03F32BA57A6F1E5EFAF5705D278A72C057B2A6C66E1F103ABA517
    SPKI SHA256: 21C612BE6A6B8DED1559F12515DE92505769E0335BF8C09A1AE38165BFF62804
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/SGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/SGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS DV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS DV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 07BC0B4AFE82F017DB7966A4589A560B398CA1
- SHA-256: 94B949699B74368B27FAD14D1EEF1F2AA2AD6AC24399A24399398B013FFB9601
- SPKI SHA-256: F409B7AB9766155A853800D4F80440B58B27D7CE8B363484D1A43A1429BABF71
- Validity: 2024-08-28 to 2034-08-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGDVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:bc:0b:4a:fe:82:f0:17:db:79:66:a4:58:9a:56:0b:39:8c:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Aug 28 10:14:49 2024 GMT
            Not After : Aug 28 10:13:49 2034 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS DV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                ED:15:06:41:F2:21:90:6C:97:22:04:81:D4:3D:D0:87:CE:E8:25:C4
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 94B949699B74368B27FAD14D1EEF1F2AA2AD6AC24399A24399398B013FFB9601
    SPKI SHA256: F409B7AB9766155A853800D4F80440B58B27D7CE8B363484D1A43A1429BABF71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS DV CA, Level 2

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS DV CA, Level 2
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 07CE18ED0549DB4432F95E8BA03C9D78446EA9
- SHA-256: 2FCA9DE7A0656B9F2655C8C903064B7EEA4785A40FB2707E1D6394682EB76998
- SPKI SHA-256: 53B1C68008018782E87DEF1D185E0480535D0F2BB81C1525139C3039E5D32FB7
- Validity: 2025-02-26 to 2035-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGDVCA_L2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:05:49:db:44:32:f9:5e:8b:a0:3c:9d:78:44:6e:a9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb 26 10:44:51 2025 GMT
            Not After : Feb 24 16:44:51 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS DV CA, Level 2"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                52:71:4F:9A:79:21:E7:CC:FC:C4:24:EF:8C:B4:8B:84:C9:15:59:E3
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2FCA9DE7A0656B9F2655C8C903064B7EEA4785A40FB2707E1D6394682EB76998
    SPKI SHA256: 53B1C68008018782E87DEF1D185E0480535D0F2BB81C1525139C3039E5D32FB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS EV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS EV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 07CE18ECEFEE27577C1AA3A62888728009963E
- SHA-256: 545AACD57FC0F24E92181853F8AD8E511D92624FDA83593B89E931FCEE82ED6A
- SPKI SHA-256: 7F2672AAD7ACE21AFF26CFB7D6EAFB45AAADCCAC7FF5774546193E539434D712
- Validity: 2025-02-26 to 2035-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGEVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:ef:ee:27:57:7c:1a:a3:a6:28:88:72:80:09:96:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS EV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                D9:2A:05:A9:58:27:E2:84:0D:BB:59:BF:1D:CF:F8:58:41:4E:66:9E
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 545AACD57FC0F24E92181853F8AD8E511D92624FDA83593B89E931FCEE82ED6A
    SPKI SHA256: 7F2672AAD7ACE21AFF26CFB7D6EAFB45AAADCCAC7FF5774546193E539434D712
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS IV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS IV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 07CE18ECFEC41AB34D32D4C870F19DA16397B2
- SHA-256: 4F879353F698CE839CB57B6F315BD227817B12AAEDF8FAC571F26AFCE01BE4EC
- SPKI SHA-256: D04388B551576A19C46A33DDC18FFE6FB800BE8772EEA03C5B87C6323A789129
- Validity: 2025-02-26 to 2035-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGIVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:fe:c4:1a:b3:4d:32:d4:c8:70:f1:9d:a1:63:97:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS IV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                0A:13:E3:DE:BC:80:37:42:0C:AD:52:77:32:83:D4:F4:84:30:D7:00
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4F879353F698CE839CB57B6F315BD227817B12AAEDF8FAC571F26AFCE01BE4EC
    SPKI SHA256: D04388B551576A19C46A33DDC18FFE6FB800BE8772EEA03C5B87C6323A789129
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.3
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS OV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS OV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global Certification Authority
- Serial: 07CE18ECF8D5BFF93EEC9391A80D24994C437A
- SHA-256: B126AAD1C17CEE9EEF0F2CEDC06BC6786F19E48A079929F93C13AB48CA30EC60
- SPKI SHA-256: A8DF2B47F4AB5FF6AFEE416B4CC5435706B18D2FF884FA822C2445C694ED6F94
- Validity: 2025-02-26 to 2035-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGOVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:f8:d5:bf:f9:3e:ec:93:91:a8:0d:24:99:4c:43:7a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS OV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FF:1E:05:E1:96:3C:1C:04:EE:CC:CE:72:66:0F:18:F0:5E:C0:6D:BA
            X509v3 Authority Key Identifier:
                99:E0:19:67:0D:62:DB:76:B3:DA:3D:B8:5B:E8:FD:42:D2:31:0E:87
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B126AAD1C17CEE9EEF0F2CEDC06BC6786F19E48A079929F93C13AB48CA30EC60
    SPKI SHA256: A8DF2B47F4AB5FF6AFEE416B4CC5435706B18D2FF884FA822C2445C694ED6F94
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P2 DV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 DV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 07CE18ED075A180CE72A7E3446FEA173E1E749
- SHA-256: 53A1808C75A317553A1C3B0F08A186A73844F2E96353D58A666167AA2C614700
- SPKI SHA-256: 794FF2FAC7BFBCE2D11328E457A6DA82A6027E79BA905B4929D251E5ED642DD1
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP2DVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:07:5a:18:0c:e7:2a:7e:34:46:fe:a1:73:e1:e7:49
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb 26 10:44:51 2025 GMT
            Not After : Feb 24 16:44:51 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P2 DV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                E9:37:53:F2:39:16:1E:FE:0A:03:D5:61:82:F5:64:E3:A5:77:6E:97
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 53A1808C75A317553A1C3B0F08A186A73844F2E96353D58A666167AA2C614700
    SPKI SHA256: 794FF2FAC7BFBCE2D11328E457A6DA82A6027E79BA905B4929D251E5ED642DD1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P2 EV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 EV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 07CE18ECF456C9AAF7271E5BE9BA26CF263135
- SHA-256: 784BC859AD8D61A50A914C357C14B82814D6F6E3DC713DF8DD18BD9F37DEC408
- SPKI SHA-256: 47878DBFECFABB42B36B27A8D4D75924831F2DB17549A54F41F84D3D0203043E
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP2EVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:f4:56:c9:aa:f7:27:1e:5b:e9:ba:26:cf:26:31:35
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P2 EV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                09:22:6E:5A:CE:B0:72:97:11:15:12:46:95:C6:3B:BD:FD:84:51:10
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 784BC859AD8D61A50A914C357C14B82814D6F6E3DC713DF8DD18BD9F37DEC408
    SPKI SHA256: 47878DBFECFABB42B36B27A8D4D75924831F2DB17549A54F41F84D3D0203043E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P2 IV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 IV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 07CE18ED00D45857AFED9E4038180AC1ACBA0F
- SHA-256: 579C53B9062046C3F39A7D60306E3A8E1BA1B6E8E6E8786445A24792FC671BD8
- SPKI SHA-256: B1BDF42B823BBB3AA8FD02FEAB8C2F9C9580105E3E1A5E9D0460420A1F3E1D34
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP2IVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:00:d4:58:57:af:ed:9e:40:38:18:0a:c1:ac:ba:0f
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P2 IV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                04:38:C8:A2:33:91:98:80:35:4B:42:6C:91:A7:FC:E3:76:2D:4A:90
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: 579C53B9062046C3F39A7D60306E3A8E1BA1B6E8E6E8786445A24792FC671BD8
    SPKI SHA256: B1BDF42B823BBB3AA8FD02FEAB8C2F9C9580105E3E1A5E9D0460420A1F3E1D34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.3
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P2 OV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P2 OV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P256 Certification Authority
- Serial: 07CE18ECFAE6EFEA7DEF67DFDAC0959553D47C
- SHA-256: A750D984BCDC86F95137DEC4F3F728C4DE9061574CE7ECD3A549780C3814AE67
- SPKI SHA-256: 784472B54FF8B741552FC70AAC2F4C7BBE0BCD38F4B765FF1376277597F18885
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 256 prime256v1
- Signature Algorithm: ecdsa-with-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP2OVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:fa:e6:ef:ea:7d:ef:67:df:da:c0:95:95:53:d4:7c
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P256 Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P2 OV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                FF:BE:30:38:16:3B:A7:34:C5:EB:EE:15:24:63:69:2F:D7:00:7D:DB
            X509v3 Authority Key Identifier:
                A3:41:06:AC:90:6D:D1:4A:EB:75:A5:4A:10:99:B3:B1:A1:8B:4A:F7
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP256CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP256CA.crt
    Signature Algorithm: ecdsa-with-SHA256
    SHA256 Fingerprint: A750D984BCDC86F95137DEC4F3F728C4DE9061574CE7ECD3A549780C3814AE67
    SPKI SHA256: 784472B54FF8B741552FC70AAC2F4C7BBE0BCD38F4B765FF1376277597F18885
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP256CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP256CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P3 DV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 DV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 07CE18ED087C72EB533E0CDA0843A79CD4BF0C
- SHA-256: A043E4F739C46F9824E20F04482F2CE42A58169E494CCCD2C15B5F5487315847
- SPKI SHA-256: FAB67EA072258BDBE784114C15C6151B33D9671B05E0446DEFF95E8B4EE50EEC
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP3DVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:08:7c:72:eb:53:3e:0c:da:08:43:a7:9c:d4:bf:0c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb 26 10:44:51 2025 GMT
            Not After : Feb 24 16:44:51 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P3 DV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                50:11:18:D2:FD:35:29:A5:01:16:26:35:CF:E7:95:63:E9:9C:0C:97
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A043E4F739C46F9824E20F04482F2CE42A58169E494CCCD2C15B5F5487315847
    SPKI SHA256: FAB67EA072258BDBE784114C15C6151B33D9671B05E0446DEFF95E8B4EE50EEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P3 EV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 EV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 07CE18ECF57F3863D8CC87419CB7DF49C10898
- SHA-256: 6A704E7BF3DB67DBD0A74BD810FE922E77A2D459B253D77CF4B6F88EA0F6E4CF
- SPKI SHA-256: 30EC26FC404D7693D2C9F434F6172135ED3E67BD1A404B5548F0C9FE99E7337A
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP3EVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:f5:7f:38:63:d8:cc:87:41:9c:b7:df:49:c1:08:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P3 EV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                EB:BF:0B:6C:6C:63:2E:61:74:76:D7:51:86:82:4C:FA:48:45:11:46
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6A704E7BF3DB67DBD0A74BD810FE922E77A2D459B253D77CF4B6F88EA0F6E4CF
    SPKI SHA256: 30EC26FC404D7693D2C9F434F6172135ED3E67BD1A404B5548F0C9FE99E7337A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P3 IV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 IV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 07CE18ED01FA2FAC388ED11C045149591CD809
- SHA-256: 03FC04C2E2DE35171046AD4F481B2E16AF4F029E6483C6B3845D1F383F2D1BBC
- SPKI SHA-256: 6A97BAA77A08019561478D459CC0960769A787E92BF5FBC77B3433A518A4AA70
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP3IVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.3 CABF IV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:01:fa:2f:ac:38:8e:d1:1c:04:51:49:59:1c:d8:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb 26 10:44:51 2025 GMT
            Not After : Feb 24 16:44:51 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P3 IV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                9A:5D:6E:FB:70:32:73:5B:8E:CF:BB:83:03:72:45:DC:2B:02:81:B4
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 03FC04C2E2DE35171046AD4F481B2E16AF4F029E6483C6B3845D1F383F2D1BBC
    SPKI SHA256: 6A97BAA77A08019561478D459CC0960769A787E92BF5FBC77B3433A518A4AA70
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.3
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud TWG TLS P3 OV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud TWG TLS P3 OV CA, Level 1
- Issuer: countryName=US, stateOrProvinceName=Illinois, localityName=Chicago, organizationName=Trustwave Holdings, Inc., commonName=Trustwave Global ECC P384 Certification Authority
- Serial: 07CE18ECFC0B3372F33E1906C7BF21870E9B38
- SHA-256: 9773684CDC33F580BA1326A257D725CD47ED84B5829B1C58114F811C33D68F16
- SPKI SHA-256: 0D84760E129AE5231CD78B47B4B09646D52F3E9CB247FD29553515BA448FF29D
- Validity: 2025-02-26 to 2035-02-24
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCTWGP3OVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ec:fc:0b:33:72:f3:3e:19:06:c7:bf:21:87:0e:9b:38
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, ST = Illinois, L = Chicago, O = "Trustwave Holdings, Inc.", CN = Trustwave Global ECC P384 Certification Authority
        Validity
            Not Before: Feb 26 10:44:50 2025 GMT
            Not After : Feb 24 16:44:50 2035 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud TWG TLS P3 OV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Key Identifier:
                DF:BA:AE:63:9F:BB:B8:30:4B:8A:A1:18:08:31:E6:49:25:01:84:4B
            X509v3 Authority Key Identifier:
                55:A9:84:89:D2:C1:32:BD:18:CB:6C:A6:07:4E:C8:E7:9D:BE:82:90
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/TWGP384CA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/TWGP384CA.crt
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9773684CDC33F580BA1326A257D725CD47ED84B5829B1C58114F811C33D68F16
    SPKI SHA256: 0D84760E129AE5231CD78B47B4B09646D52F3E9CB247FD29553515BA448FF29D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/TWGP384CA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/TWGP384CA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### VikingCloud XG Secure Email CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud XG Secure Email CA, Level 1
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07BC0B4B026EA44A76BC1233E81D8FCF389FC5
- SHA-256: 434BF66BD4A8E461B810864D82D35C3100BE5D98E63C67C6CA7422FA6F75A1CC
- SPKI SHA-256: 44510787F67E8262B1131CF457DFA8BD1B60A9879A77223F31911481513587D6
- Validity: 2024-08-28 to 2034-08-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCXGSMCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:bc:0b:4b:02:6e:a4:4a:76:bc:12:33:e8:1d:8f:cf:38:9f:c5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Aug 28 10:14:49 2024 GMT
            Not After : Aug 28 10:13:49 2034 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud XG Secure Email CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Subject Key Identifier:
                58:5D:19:BB:9A:F5:74:AA:02:99:92:F3:6F:CC:8E:E8:F3:EC:B1:77
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5
                  CPS: https://certs.securetrust.com/CA
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 434BF66BD4A8E461B810864D82D35C3100BE5D98E63C67C6CA7422FA6F75A1CC
    SPKI SHA256: 44510787F67E8262B1131CF457DFA8BD1B60A9879A77223F31911481513587D6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.vikingcloud.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### VikingCloud XG TLS EV CA, Level 1

- Subject: countryName=US, organizationName=Viking Cloud, Inc., commonName=VikingCloud XG TLS EV CA, Level 1
- Issuer: countryName=US, organizationalUnitName=www.xrampsecurity.com, organizationName=XRamp Security Services Inc, commonName=XRamp Global Certification Authority
- Serial: 07CE18ED0EDB4BA6D6185A0FC2E0B4AD74D558
- SHA-256: D8603B6BFB05F4FDFB3ECCA05258FF90E942F4E2635033CF2449C1C7CF4636F9
- SPKI SHA-256: F50ED9AFF74309D2A42669BC3464B53DA804052477813D8DEB755FC98648EAD5
- Validity: 2025-02-26 to 2034-02-24
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.vikingcloud.com/VCXGEVCA_L1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.vikingcloud.com/
- CRL DP: http://crl.vikingcloud.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:ce:18:ed:0e:db:4b:a6:d6:18:5a:0f:c2:e0:b4:ad:74:d5:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = www.xrampsecurity.com, O = XRamp Security Services Inc, CN = XRamp Global Certification Authority
        Validity
            Not Before: Feb 26 10:44:51 2025 GMT
            Not After : Feb 24 16:44:51 2034 GMT
        Subject: C = US, O = "Viking Cloud, Inc.", CN = "VikingCloud XG TLS EV CA, Level 1"
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Subject Key Identifier:
                D9:F2:73:CE:47:C3:E9:BC:2C:76:2F:2D:19:56:23:7B:A7:AE:15:F5
            X509v3 Authority Key Identifier:
                C6:4F:A2:3D:06:63:84:09:9C:CE:62:E4:04:AC:8D:5C:B5:E9:B6:1B
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.vikingcloud.com/XGCA.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.vikingcloud.com/
                CA Issuers - URI:http://certs.securetrust.com/issuers/XGCA.crt
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D8603B6BFB05F4FDFB3ECCA05258FF90E942F4E2635033CF2449C1C7CF4636F9
    SPKI SHA256: F50ED9AFF74309D2A42669BC3464B53DA804052477813D8DEB755FC98648EAD5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.vikingcloud.com/
- AIA CA Issuers: http://certs.securetrust.com/issuers/XGCA.crt
- CRL Distribution Points: http://crl.vikingcloud.com/XGCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus Code Signing RSA CA 1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus Code Signing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Code Signing Transit RSA CA R2
- Serial: 2195EC664035673BEBA85E1F0F4BACAA
- SHA-256: 2EC68E4EBEF62DBCAD2934BA6E87DAA954AA628018FCA696150BFEEF3D9093A3
- SPKI SHA-256: C4462FE8011950D78D961B287611A100300DA696FBACD2D8A5F6B9C8158CAFE6
- Validity: 2025-05-07 to 2033-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-codeSigning-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-CodeSigning-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:95:ec:66:40:35:67:3b:eb:a8:5e:1f:0f:4b:ac:aa
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Code Signing Transit RSA CA R2
        Validity
            Not Before: May  7 19:23:37 2025 GMT
            Not After : May  5 19:23:36 2033 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus Code Signing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                AB:24:A9:2E:53:D8:98:D5:CB:97:CE:4F:82:57:24:7B:9E:51:EF:12
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-CodeSigning-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-CodeSigning-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                57:09:C6:DC:64:68:97:F3:46:2F:75:DC:12:40:C1:55:16:8C:31:47
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2EC68E4EBEF62DBCAD2934BA6E87DAA954AA628018FCA696150BFEEF3D9093A3
    SPKI SHA256: C4462FE8011950D78D961B287611A100300DA696FBACD2D8A5F6B9C8158CAFE6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-CodeSigning-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-CodeSigning-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### ZoTrus Document Signing RSA CA 1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus Document Signing RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com Document Signing Transit RSA CA R2
- Serial: 22883DBE2B00C8C412F2A303C9EC299E
- SHA-256: CE20BD2FA55136E157F5A8B7CEEB6B459DB8F0B72C37CAD8450685105DFA8241
- SPKI SHA-256: 5E110C08AAFA088B69CDE3309DCD7DD28D69DF7601454DD2703A27481D7E78F9
- Validity: 2025-05-07 to 2033-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-docSigning-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:88:3d:be:2b:00:c8:c4:12:f2:a3:03:c9:ec:29:9e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com Document Signing Transit RSA CA R2
        Validity
            Not Before: May  7 19:22:22 2025 GMT
            Not After : May  5 19:22:21 2033 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus Document Signing RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                88:41:20:FC:3F:A5:57:CF:64:86:22:AB:26:37:21:6E:18:FC:6F:B4
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                14:75:87:45:4B:59:2F:BE:B3:81:5D:28:6C:E0:6E:ED:BB:09:3C:01
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CE20BD2FA55136E157F5A8B7CEEB6B459DB8F0B72C37CAD8450685105DFA8241
    SPKI SHA256: 5E110C08AAFA088B69CDE3309DCD7DD28D69DF7601454DD2703A27481D7E78F9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### ZoTrus Document Signing RSA CA 2

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus Document Signing RSA CA 2
- Issuer: countryName=US, organizationName=SSL Corp, commonName=SSL.com Document Signing Transit RSA CA R1
- Serial: 55A728B4995EB31D313C315FB1635728
- SHA-256: ECC45045772FBB5DABBB06168CAF51776B080A105807AC53FE3CAAEF9E97FDED
- SPKI SHA-256: 124B3CE17E1C0748DFD807ADDD99387115151D7661E62BAC0571B1D58435EED1
- Validity: 2025-05-28 to 2033-05-26
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-docSigning-I-R2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:a7:28:b4:99:5e:b3:1d:31:3c:31:5f:b1:63:57:28
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corp, CN = SSL.com Document Signing Transit RSA CA R1
        Validity
            Not Before: May 28 17:25:30 2025 GMT
            Not After : May 26 17:25:29 2033 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus Document Signing RSA CA 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                C5:7C:D2:40:1E:7F:F8:A6:12:D9:05:B9:52:DB:31:67:64:72:3B:B4
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
            X509v3 Subject Key Identifier:
                74:D1:C4:6B:2D:40:CB:0C:07:54:87:88:9A:B2:71:A1:92:87:19:85
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: ECC45045772FBB5DABBB06168CAF51776B080A105807AC53FE3CAAEF9E97FDED
    SPKI SHA256: 124B3CE17E1C0748DFD807ADDD99387115151D7661E62BAC0571B1D58435EED1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-docSigning-T-RSA-R1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-docSigning-T-RSA-R1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### ZoTrus DV TLS ECC CA 1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus DV TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com TLS Transit ECC CA R2
- Serial: 6EA2137D92FC513045DA31F5789E52C5
- SHA-256: FF93C10D46B63242394B8891C398A156D20B81F0B918EE52EB9F539126C80D97
- SPKI SHA-256: 3FA0CC06EE7A0933C474907652218ADCF42AD9B31CF3140B3974A0EFB5873B88
- Validity: 2025-05-07 to 2035-05-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-DVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:a2:13:7d:92:fc:51:30:45:da:31:f5:78:9e:52:c5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com TLS Transit ECC CA R2
        Validity
            Not Before: May  7 19:15:25 2025 GMT
            Not After : May  5 19:15:24 2035 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus DV TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                32:A2:C7:D8:58:8B:FF:7F:C0:3C:F2:55:69:33:EC:CE:CC:1F:BC:97
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                F6:1F:92:F8:EF:15:1D:E2:8C:BC:ED:7D:60:2B:92:B5:F9:B9:29:C7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FF93C10D46B63242394B8891C398A156D20B81F0B918EE52EB9F539126C80D97
    SPKI SHA256: 3FA0CC06EE7A0933C474907652218ADCF42AD9B31CF3140B3974A0EFB5873B88
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-TLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### ZoTrus EV TLS ECC CA 1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus EV TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com EV TLS Transit ECC CA R2
- Serial: 07B9764692F10A687BA9DE5DCB581C09
- SHA-256: 1B18C2641FABBF87AF6B1ADEED01D5F234FB1032A70ABF7C36FEAE7A06C10F3C
- SPKI SHA-256: F4CDDE900ECB7516ABCBB5BB48273B33C7577356B02CA3C7981352D20014D66C
- Validity: 2025-05-07 to 2035-05-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-EVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            07:b9:76:46:92:f1:0a:68:7b:a9:de:5d:cb:58:1c:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com EV TLS Transit ECC CA R2
        Validity
            Not Before: May  7 19:19:02 2025 GMT
            Not After : May  5 19:19:01 2035 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus EV TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                37:30:1E:64:2D:19:68:F3:FD:6E:B1:72:0D:EF:6C:FB:0A:40:4C:90
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-EVTLS-T-ECC-R2.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
            X509v3 Subject Key Identifier:
                C1:4F:40:B0:CA:F5:BD:8C:B3:06:64:AB:2B:FB:F6:B5:BB:99:6D:11
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1B18C2641FABBF87AF6B1ADEED01D5F234FB1032A70ABF7C36FEAE7A06C10F3C
    SPKI SHA256: F4CDDE900ECB7516ABCBB5BB48273B33C7577356B02CA3C7981352D20014D66C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-EVTLS-T-ECC-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-EVTLS-T-ECC-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus OV TLS ECC CA 1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus OV TLS ECC CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com OV TLS Transit ECC CA 1
- Serial: 4896D2BAE0D28B93EEB28FAC81A2C86E
- SHA-256: 689164A2B9F03C0E5E4D616CB1F453BDD5FC1A3D1C6ED93568C83A3812A7FC20
- SPKI SHA-256: 42D2893F088D24FF71664FFF5E5DD8BF78CA04AE3C945489E970BA7E8CA89EDD
- Validity: 2025-05-07 to 2035-05-05
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-OVTLS-I-E1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsps.ssl.com
- CRL DP: http://crls.ssl.com/SSL.com-OVTLS-T-E1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:96:d2:ba:e0:d2:8b:93:ee:b2:8f:ac:81:a2:c8:6e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = SSL Corporation, CN = SSL.com OV TLS Transit ECC CA 1
        Validity
            Not Before: May  7 19:17:49 2025 GMT
            Not After : May  5 19:17:48 2035 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus OV TLS ECC CA 1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B1:E0:D9:BF:9D:4B:7C:A1:2F:CA:69:43:56:28:56:4F:69:9C:17:6D
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-OVTLS-T-E1.cer
                OCSP - URI:http://ocsps.ssl.com
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-OVTLS-T-E1.crl
            X509v3 Subject Key Identifier:
                09:6A:81:9E:37:86:0D:64:75:2A:C7:C5:9B:D5:56:FD:B2:9E:0B:3F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 689164A2B9F03C0E5E4D616CB1F453BDD5FC1A3D1C6ED93568C83A3812A7FC20
    SPKI SHA256: 42D2893F088D24FF71664FFF5E5DD8BF78CA04AE3C945489E970BA7E8CA89EDD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsps.ssl.com
- AIA CA Issuers: http://cert.ssl.com/SSL.com-OVTLS-T-E1.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-OVTLS-T-E1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus S/MIME RSA CA 1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus S/MIME RSA CA 1
- Issuer: countryName=US, organizationName=SSL Corporation, commonName=SSL.com S/MIME Transit RSA CA R2
- Serial: 24FEB8A198DA474CD56424F784C9829F
- SHA-256: 1EF9EB00D2C0D39C315F2585C6A8C2EF7B50CA126BF363E31177BF402E61D613
- SPKI SHA-256: 9A320C1595E05B6C887C54F27EA84529B1D4C09F0A3EDA472919413417885DDB
- Validity: 2025-05-07 to 2033-05-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crls.ssl.com/ZoTrus-SMIME-I-R1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:fe:b8:a1:98:da:47:4c:d5:64:24:f7:84:c9:82:9f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = SSL Corporation, CN = SSL.com S/MIME Transit RSA CA R2
        Validity
            Not Before: May  7 19:20:18 2025 GMT
            Not After : May  5 19:20:17 2033 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus S/MIME RSA CA 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                F8:73:64:82:77:12:8C:7E:A4:3D:6A:05:0A:58:FF:AA:E8:51:B6:39
            Authority Information Access:
                CA Issuers - URI:http://cert.ssl.com/SSL.com-SMIME-T-RSA-R2.cer
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.ssl.com/repository
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
            X509v3 Subject Key Identifier:
                D5:32:5E:FF:41:4C:FD:7E:19:34:12:EB:93:8B:BE:D8:CB:DC:88:43
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1EF9EB00D2C0D39C315F2585C6A8C2EF7B50CA126BF363E31177BF402E61D613
    SPKI SHA256: 9A320C1595E05B6C887C54F27EA84529B1D4C09F0A3EDA472919413417885DDB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://cert.ssl.com/SSL.com-SMIME-T-RSA-R2.cer
- CRL Distribution Points: http://crls.ssl.com/SSL.com-SMIME-T-RSA-R2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
