# CA Owner Audit Dump - Shanghai Electronic Certification Authority Co., Ltd.

Generated: 2026-07-28T13:45:40.042643Z

## CA Owner Summary

- Name: Shanghai Electronic Certification Authority Co., Ltd.
- Country: China
- Website: -
- Problem Reporting: report[at]sheca[dot]com
- CP/CPS URLs: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md, https://assets-cdn.sheca.com/documents/CP-CPS-CodeSigning-v1.1.md, https://assets-cdn.sheca.com/documents/CP-CPS-SMIME-v1.1.md
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://cert.webtrust.org/SealFile?seal=2045&file=pdf, https://cert.webtrust.org/SealFile?seal=2047&file=pdf
- Root Programs: {"mozilla":"Included","chrome":"Included","microsoft":"Included","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: report[at]sheca[dot]com
- CP/CPS URLs: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md, https://assets-cdn.sheca.com/documents/CP-CPS-CodeSigning-v1.1.md, https://assets-cdn.sheca.com/documents/CP-CPS-SMIME-v1.1.md
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://cert.webtrust.org/SealFile?seal=2045&file=pdf, https://cert.webtrust.org/SealFile?seal=2047&file=pdf
- Repository URLs: https://www.sheca.com/repository
- Root programs: {"mozilla":"Included","chrome":"Included","microsoft":"Included","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root | yes | unknown | 2015-03-13 to 2038-12-31 | - | - | - | clean |
| 2 | countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root | yes | unknown | 2016-03-11 to 2040-12-31 | - | - | - | clean |
| 3 | countryName=CN, organizationName=UniTrust, commonName=UCA Global Root | yes | unknown | 2008-01-01 to 2037-12-31 | - | - | TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing | current errors: 3 |
| 4 | countryName=CN, organizationName=UniTrust, commonName=UCA Root | yes | unknown | 2004-01-01 to 2029-12-31 | - | - | TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing | current errors: 3 |
| 5 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing ECC Root CA R2 | yes | unknown | 2024-03-27 to 2049-03-27 | - | - | - | current errors: 1 |
| 6 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing RSA Root CA R1 | yes | unknown | 2024-03-27 to 2049-03-27 | - | - | - | clean |
| 7 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME ECC Root CA R2 | yes | unknown | 2024-03-27 to 2039-03-27 | - | - | - | current errors: 1 |
| 8 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME RSA Root CA R1 | yes | unknown | 2024-03-27 to 2039-03-27 | - | - | - | clean |
| 9 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping ECC Root CA R2 | yes | unknown | 2024-03-27 to 2049-03-27 | - | - | - | current errors: 1 |
| 10 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping RSA Root CA R1 | yes | unknown | 2024-03-27 to 2049-03-27 | - | - | - | clean |
| 11 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2 | yes | unknown | 2024-03-27 to 2039-03-27 | - | - | - | current errors: 1 |
| 12 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1 | yes | unknown | 2024-03-27 to 2039-03-27 | - | - | - | clean |
| 13 | countryName=CN, organizationName=赛尔教育科技发展有限公司, commonName=cerschool OV TLS RSA CA G1 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 14 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM DV TLS ECC CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.1, 1.2.156.112570.1.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 15 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM DV TLS RSA CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.1, 1.2.156.112570.1.1.1 | 0 | TLS Web Server Authentication | clean |
| 16 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM OV TLS ECC CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.2, 1.2.156.112570.1.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 17 | countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM OV TLS RSA CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.2, 1.2.156.112570.1.1.2 | 0 | TLS Web Server Authentication | clean |
| 18 | countryName=CN, organizationName=Tianyi Security Technology Co., Ltd., commonName=CT2 DV TLS RSA CA G1 | yes | current | 2024-12-04 to 2034-12-04 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 19 | countryName=CN, organizationName=China Telecom Cybersecurity Technology Co.,Ltd., commonName=CT2 DV TLS RSA CA G2 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 20 | countryName=CN, organizationName=Tianyi Security Technology Co., Ltd., commonName=CT2 OV TLS RSA CA G1 | yes | current | 2024-12-04 to 2034-12-04 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 21 | countryName=CN, organizationName=China Telecom Cybersecurity Technology Co.,Ltd., commonName=CT2 OV TLS RSA CA G2 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 22 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS ECC CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 23 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS RSA CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 24 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod OV TLS ECC CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 25 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod OV TLS RSA CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 26 | countryName=CN, organizationName=Shenzhen Yamu Security Technology Co., Ltd., commonName=HTTPS Automation Research RSA DV SSL CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 27 | countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI DV TLS ECC CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.1, 1.2.156.112570.1.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 28 | countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI DV TLS RSA CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.1, 1.2.156.112570.1.1.1 | 0 | TLS Web Server Authentication | clean |
| 29 | countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI OV TLS ECC CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.2, 1.2.156.112570.1.1.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 30 | countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI OV TLS RSA CA 2026 | yes | current | 2026-04-26 to 2029-04-22 | 2.23.140.1.2.2, 1.2.156.112570.1.1.2 | 0 | TLS Web Server Authentication | clean |
| 31 | countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL DV Secure Server CA | yes | current | 2024-04-14 to 2034-04-14 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 32 | countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL DV Secure Server CA G1 | yes | current | 2024-04-27 to 2034-04-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 33 | countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL OV Secure Server CA | yes | current | 2024-04-14 to 2034-04-14 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 34 | countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL OV Secure Server CA G1 | yes | current | 2024-04-27 to 2034-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 35 | countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust DV TLS RSA CA G1 | yes | current | 2024-04-14 to 2034-04-14 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 36 | countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust DV TLS RSA CA G2 | yes | current | 2024-04-27 to 2034-04-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 37 | countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust OV TLS RSA CA G1 | yes | current | 2024-04-14 to 2034-04-14 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 38 | countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust OV TLS RSA CA G2 | yes | current | 2024-04-27 to 2034-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 39 | countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Business ECC CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 40 | countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Business RSA CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 41 | countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Domain ECC CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 42 | countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Domain RSA CA G1 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 43 | countryName=CN, organizationName=北京中科三方网络技术有限公司, commonName=SanFront DV TLS RSA CA G1 | yes | current | 2025-09-17 to 2030-09-17 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 44 | countryName=CN, organizationName=北京国科云计算技术有限公司, commonName=SanFront DV TLS RSA CA G2 | yes | current | 2025-11-11 to 2030-11-11 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 45 | countryName=CN, organizationName=北京中科三方网络技术有限公司, commonName=SanFront OV TLS RSA CA G1 | yes | current | 2025-09-17 to 2030-09-17 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 46 | countryName=CN, organizationName=北京国科云计算技术有限公司, commonName=SanFront OV TLS RSA CA G2 | yes | current | 2025-11-11 to 2030-11-11 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 47 | countryName=CN, organizationName=UniTrust, commonName=SHECA Code Signing CA G4 | yes | revoked | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.2.1, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 48 | countryName=CN, organizationName=UniTrust, commonName=SHECA Code Signing ECC CA 2A | yes | current | 2024-03-27 to 2039-03-27 | 1.2.156.112570.1.2.1, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 49 | countryName=CN, organizationName=UniTrust, commonName=SHECA Code Signing RSA CA 1B | yes | current | 2024-05-27 to 2039-05-27 | 1.2.156.112570.1.2.1, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 50 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV Server CA G5 | yes | current | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 51 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS ECC CA 2026 S1 | yes | current | 2026-02-08 to 2029-02-04 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 52 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS ECC CA 2A | yes | revoked | 2024-03-27 to 2029-03-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 53 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS ECC CA G6 | yes | current | 2024-12-04 to 2034-12-04 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 54 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS RSA CA 1A | yes | revoked | 2024-03-27 to 2029-03-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 55 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS RSA CA 2026 S1 | yes | current | 2026-02-08 to 2029-02-04 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 56 | countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS RSA CA A1 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 57 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing CA G2 | yes | revoked | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.2.2, 2.23.140.1.3 | 0 | Code Signing | clean |
| 58 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing CA G3 | yes | revoked | 2024-05-27 to 2039-05-27 | 1.2.156.112570.1.2.2, 2.23.140.1.3 | 0 | Code Signing | clean |
| 59 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing ECC CA 2A | yes | current | 2024-03-27 to 2039-03-27 | 1.2.156.112570.1.2.2, 2.23.140.1.3 | 0 | Code Signing | clean |
| 60 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing RSA CA 1B | yes | current | 2024-05-27 to 2039-05-27 | 1.2.156.112570.1.2.2, 2.23.140.1.3 | 0 | Code Signing | clean |
| 61 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV Server CA G2 | yes | revoked | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 62 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV Server CA G3 | yes | current | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 63 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS ECC CA 2026 S1 | yes | current | 2026-02-08 to 2029-02-04 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 64 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS ECC CA 2A | yes | revoked | 2024-03-27 to 2029-03-27 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 65 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS ECC CA C2 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 66 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS RSA CA 1A | yes | revoked | 2024-03-27 to 2029-03-27 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 67 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS RSA CA 2026 S1 | yes | current | 2026-02-08 to 2029-02-04 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 68 | countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS RSA CA C1 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.3, 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 69 | countryName=CN, organizationName=UniTrust, commonName=SHECA Extended Validation Code Signing CA | yes | revoked | 2015-03-13 to 2030-12-31 | 2.5.29.32.0 | 0 | - | clean |
| 70 | countryName=CN, organizationName=UniTrust, commonName=SHECA Extended Validation SSL CA | yes | revoked | 2015-03-13 to 2030-12-31 | 2.5.29.32.0 | 0 | - | clean |
| 71 | countryName=CN, organizationName=UniTrust, commonName=SHECA FREE DV TLS ECC CA G2 | yes | current | 2024-12-04 to 2034-12-04 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 72 | countryName=CN, organizationName=UniTrust, commonName=SHECA FREE DV TLS RSA CA G1 | yes | current | 2024-12-04 to 2034-12-04 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 73 | countryName=CN, stateOrProvinceName=Shanghai, organizationName=UniTrust, commonName=SHECA Global G3 Code Signing | yes | revoked | 2016-03-11 to 2030-12-31 | 2.5.29.32.0 | 0 | - | clean |
| 74 | countryName=CN, stateOrProvinceName=Shanghai, organizationName=UniTrust, commonName=SHECA Global G3 SSL | yes | revoked | 2016-03-11 to 2030-12-31 | 2.5.29.32.0 | 0 | - | clean |
| 75 | countryName=CN, organizationName=UniTrust, commonName=SHECA IV SMIME ECC CA 2A | yes | current | 2024-03-27 to 2034-03-27 | 1.2.156.112570.1.9.4, 2.23.140.1.5.4.3 | 0 | E-mail Protection | clean |
| 76 | countryName=CN, organizationName=UniTrust, commonName=SHECA IV SMIME RSA CA 1A | yes | current | 2024-03-27 to 2034-03-27 | 1.2.156.112570.1.9.4, 2.23.140.1.5.4.3 | 0 | E-mail Protection | clean |
| 77 | countryName=CN, organizationName=UniTrust, commonName=SHECA MV SMIME ECC CA 2A | yes | current | 2024-03-27 to 2034-03-27 | 1.2.156.112570.1.9.1, 2.23.140.1.5.1.3 | 0 | E-mail Protection | current errors: 1 |
| 78 | countryName=CN, organizationName=UniTrust, commonName=SHECA MV SMIME RSA CA 1A | yes | current | 2024-03-27 to 2034-03-27 | 1.2.156.112570.1.9.1, 2.23.140.1.5.1.3 | 0 | E-mail Protection | current errors: 1 |
| 79 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV Server CA G5 | yes | current | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 80 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV Server CA G6 | yes | revoked | 2022-11-08 to 2037-11-08 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 81 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV Server CA G7 | yes | revoked | 2023-03-28 to 2038-03-28 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 82 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV SMIME ECC CA 2A | yes | current | 2024-03-27 to 2034-03-27 | 1.2.156.112570.1.9.2, 2.23.140.1.5.2.3 | 0 | E-mail Protection | clean |
| 83 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV SMIME RSA CA 1A | yes | current | 2024-03-27 to 2034-03-27 | 1.2.156.112570.1.9.2, 2.23.140.1.5.2.3 | 0 | E-mail Protection | clean |
| 84 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS ECC CA 2026 S1 | yes | current | 2026-02-08 to 2029-02-04 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 85 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS ECC CA 2A | yes | revoked | 2024-03-27 to 2029-03-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | historical errors: 1 |
| 86 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS ECC CA G6 | yes | current | 2024-12-04 to 2034-12-04 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 87 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS RSA CA 1A | yes | revoked | 2024-03-27 to 2029-03-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 88 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS RSA CA 2026 S1 | yes | current | 2026-02-08 to 2029-02-04 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 89 | countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS RSA CA A1 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 90 | countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Code Signing CA G3 | yes | revoked | 2018-04-27 to 2033-04-27 | 1.2.156.112570.1.2.1, 2.23.140.1.4.1 | 0 | Code Signing | historical errors: 1 |
| 91 | countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Domain Validation Server CA G3 | yes | revoked | 2018-04-27 to 2033-04-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 92 | countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Extended Validation Code Signing CA | yes | revoked | 2018-04-27 to 2033-04-27 | 1.2.156.112570.1.2.2, 1.2.156.112570.1.2.3, 2.23.140.1.4.1, 2.23.140.1.3 | 0 | Code Signing | historical errors: 1 |
| 93 | countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Extended Validation Server CA | yes | revoked | 2018-04-27 to 2033-04-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 94 | countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Organization Validation Server CA G3 | yes | revoked | 2018-04-27 to 2033-04-27 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 95 | countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Time Stamp Authority G1 | yes | revoked | 2018-04-27 to 2033-04-27 | 1.2.156.112570.1.4 | 0 | Time Stamping | historical errors: 1 |
| 96 | countryName=CN, organizationName=UniTrust, commonName=SHECA SMIME CA G1 | yes | revoked | 2021-08-18 to 2036-08-18 | 1.2.156.112570.1.3.1, 1.2.156.112570.1.3.2 | 0 | E-mail Protection, TLS Web Client Authentication | clean |
| 97 | countryName=CN, organizationName=UniTrust, commonName=SHECA Time Stamping CA G2 | yes | revoked | 2021-03-16 to 2036-03-16 | 1.2.156.112570.1.4.1 | 0 | Time Stamping | clean |
| 98 | countryName=CN, organizationName=UniTrust, commonName=SHECA Time Stamping ECC CA 2A | yes | current | 2024-03-27 to 2039-03-27 | 1.2.156.112570.1.4.1, 2.23.140.1.4.2 | 0 | Time Stamping | clean |
| 99 | countryName=CN, organizationName=UniTrust, commonName=SHECA Time Stamping RSA CA 1B | yes | current | 2024-05-27 to 2039-05-27 | 1.2.156.112570.1.4.1, 2.23.140.1.4.2 | 0 | Time Stamping | clean |
| 100 | countryName=CN, organizationName=Shaanxi Digital Certificate Authority, commonName=SNCA OV TLS RSA CA G1 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 101 | countryName=CN, organizationName=sslTrus, commonName=sslTrus ECC DV TLS CA G2 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 102 | countryName=CN, organizationName=sslTrus, commonName=sslTrus ECC OV TLS CA G2 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 103 | countryName=CN, organizationName=sslTrus, commonName=sslTrus RSA DV TLS CA G2 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 104 | countryName=CN, organizationName=sslTrus, commonName=sslTrus RSA OV TLS CA G2 | yes | current | 2025-01-05 to 2035-01-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 105 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia RSA DV TLS CA - S1 | yes | revoked, expired | 2021-03-16 to 2026-03-16 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 106 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia RSA OV TLS CA - S1 | yes | revoked, expired | 2021-03-16 to 2026-03-16 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 107 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2 | yes | revoked | 2025-04-27 to 2035-04-27 | 2.5.29.32.0 | - | - | historical errors: 1 |
| 108 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2 | yes | current | 2026-02-05 to 2029-02-04 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 1 | TLS Web Server Authentication | current errors: 2 |
| 109 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1 | yes | revoked | 2025-04-27 to 2035-04-27 | 2.5.29.32.0 | - | - | clean |
| 110 | countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1 | yes | current | 2026-02-05 to 2029-02-04 | 2.23.140.1.2.1, 2.23.140.1.2.2 | 1 | TLS Web Server Authentication | current errors: 1 |
| 111 | countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet DV SSL | yes | current | 2023-07-05 to 2028-07-05 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 112 | countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet DV TLS RSA CA G2 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 113 | countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet OV SSL | yes | current | 2023-07-05 to 2028-07-05 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 114 | countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet OV TLS RSA CA G2 | yes | current | 2025-04-27 to 2035-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 115 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA DV SSL CA | yes | current | 2024-04-14 to 2034-04-14 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 116 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA DV SSL CA G1 | yes | current | 2024-04-27 to 2034-04-27 | 1.2.156.112570.1.1.1, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 117 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA OV SSL CA | yes | current | 2024-04-14 to 2034-04-14 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 118 | countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA OV SSL CA G1 | yes | current | 2024-04-27 to 2034-04-27 | 1.2.156.112570.1.1.2, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |

## Certificate Details

### UCA Extended Validation Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 4FD22B8FF564C8339E4F345866237060
- SHA-256: D43AF9B35473755C9684FC06D7D8CB70EE5C28E773FB294EB41EE71722924D24
- SPKI SHA-256: 5C41A73AB2C35DFCD771F6FD6E3E8FAC9B469D386CADDA56A95B646EB48CCA34
- Validity: 2015-03-13 to 2038-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/evg1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:d2:2b:8f:f5:64:c8:33:9e:4f:34:58:66:23:70:60
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Mar 13 00:00:00 2015 GMT
            Not After : Dec 31 00:00:00 2038 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D43AF9B35473755C9684FC06D7D8CB70EE5C28E773FB294EB41EE71722924D24
    SPKI SHA256: 5C41A73AB2C35DFCD771F6FD6E3E8FAC9B469D386CADDA56A95B646EB48CCA34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UCA Global G2 Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 5DDFB1DA5AA3ED5DBE5A6520650390EF
- SHA-256: 9BEA11C976FE014764C1BE56A6F914B5A560317ABD9988393382E5161AA0493C
- SPKI SHA-256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
- Validity: 2016-03-11 to 2040-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/globalg2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5d:df:b1:da:5a:a3:ed:5d:be:5a:65:20:65:03:90:ef
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 11 00:00:00 2016 GMT
            Not After : Dec 31 00:00:00 2040 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9BEA11C976FE014764C1BE56A6F914B5A560317ABD9988393382E5161AA0493C
    SPKI SHA256: 1255CABE8152FA64DF942F7A47417E29F96C1CE11BF8C84ECBE2815CC1280810
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UCA Global Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Global Root
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global Root
- Serial: 08
- SHA-256: A1F05CCB80C2D710EC7D479ABDCBB879E58D7EDB7149FE78A87884E3D0BAD0F9
- SPKI SHA-256: CC4997863C8C48A4CB5C3E6537DC06028D8638BE49F5F8A2BA56F2F2C8A8C779
- Validity: 2008-01-01 to 2037-12-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2045&file=pdf, https://cert.webtrust.org/SealFile?seal=2047&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 8 (0x8)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global Root
        Validity
            Not Before: Jan  1 00:00:00 2008 GMT
            Not After : Dec 31 00:00:00 2037 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Global Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints:
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing
            X509v3 Subject Key Identifier:
                D9:C3:D3:F8:80:92:67:CC:5D:D2:3A:A2:D7:71:A2:B4:C4:38:80:2D
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A1F05CCB80C2D710EC7D479ABDCBB879E58D7EDB7149FE78A87884E3D0BAD0F9
    SPKI SHA256: CC4997863C8C48A4CB5C3E6537DC06028D8638BE49F5F8A2BA56F2F2C8A8C779
```

#### Extensions

- Basic Constraints: {"present":true,"critical":false,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_basic_constraints_not_critical: Basic Constraints extension is marked as non-critical
- [current] error e_root_ca_key_usage_must_be_critical: 
- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku

### UCA Root

- Subject: countryName=CN, organizationName=UniTrust, commonName=UCA Root
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Root
- Serial: 09
- SHA-256: 93E65EC762F055DC718A332582C41A04430D72E3CB87E8B897B67516F0D1AA39
- SPKI SHA-256: A86BDAB8F480B6EB8942AB9170BDD0991971A7AD135DFBBCB7285F07A7D1E38A
- Validity: 2004-01-01 to 2029-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2045&file=pdf, https://cert.webtrust.org/SealFile?seal=2047&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9 (0x9)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Root
        Validity
            Not Before: Jan  1 00:00:00 2004 GMT
            Not After : Dec 31 00:00:00 2029 GMT
        Subject: C = CN, O = UniTrust, CN = UCA Root
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints:
                CA:TRUE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing
            X509v3 Subject Key Identifier:
                DB:1F:35:F3:6B:4C:FF:42:31:64:9B:CD:BB:5A:1E:1D:48:10:B7:EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 93E65EC762F055DC718A332582C41A04430D72E3CB87E8B897B67516F0D1AA39
    SPKI SHA256: A86BDAB8F480B6EB8942AB9170BDD0991971A7AD135DFBBCB7285F07A7D1E38A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":false,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, E-mail Protection, IPSec End System, IPSec Tunnel, IPSec User, Time Stamping, OCSP Signing
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_basic_constraints_not_critical: Basic Constraints extension is marked as non-critical
- [current] error e_root_ca_key_usage_must_be_critical: 
- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku

### UniTrust Global Code Signing ECC Root CA R2

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing ECC Root CA R2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing ECC Root CA R2
- Serial: 7D6B3DF68060A908017B9391FC4A2469
- SHA-256: 8854E81F9C6B47E438BBAE17E41F8BE4E68589AFD31A48BEE3F203F6DD3DA517
- SPKI SHA-256: D83736E6A0B241BFB85E4D7854CFBD862C744A66451A520903F3C498E03A5A5A
- Validity: 2024-03-27 to 2049-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-CodeSigning-v1.1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gcsrcar2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:6b:3d:f6:80:60:a9:08:01:7b:93:91:fc:4a:24:69
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Code Signing ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2049 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global Code Signing ECC Root CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AE:58:28:DA:2C:5C:A1:3B:20:03:6F:30:8B:B8:11:12:E5:2C:2A:BA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8854E81F9C6B47E438BBAE17E41F8BE4E68589AFD31A48BEE3F203F6DD3DA517
    SPKI SHA256: D83736E6A0B241BFB85E4D7854CFBD862C744A66451A520903F3C498E03A5A5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global Code Signing RSA Root CA R1

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing RSA Root CA R1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing RSA Root CA R1
- Serial: 734446C2E3409E48C1A1A5253D47F43A
- SHA-256: 6357353A4BBCA3D5A158C95BE9DC90F0B3E2F6A6310FD5371FCB4C41E5E1BB4C
- SPKI SHA-256: 56CBC09A90AD0A647266B4E578DA23FA2679D5D12513BA1D25A2DB47B7D0FF7F
- Validity: 2024-03-27 to 2049-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-CodeSigning-v1.1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gcsrcar1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:44:46:c2:e3:40:9e:48:c1:a1:a5:25:3d:47:f4:3a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Code Signing RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2049 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global Code Signing RSA Root CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                06:7A:4B:64:AE:B4:0D:BD:40:08:29:22:7D:41:EB:11:5F:5D:1A:B6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6357353A4BBCA3D5A158C95BE9DC90F0B3E2F6A6310FD5371FCB4C41E5E1BB4C
    SPKI SHA256: 56CBC09A90AD0A647266B4E578DA23FA2679D5D12513BA1D25A2DB47B7D0FF7F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global SMIME ECC Root CA R2

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME ECC Root CA R2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME ECC Root CA R2
- Serial: 1A811B2A882B8B93E9670E20859A6B56
- SHA-256: 6F4E2464D216A1E0B558BB204259B4A545AEB948957AA3EAF11B2F4DE1AFEF10
- SPKI SHA-256: A454645DAC8DE37A799427B6CC411D1ED14C752009928E9F963D20BEC6CCA107
- Validity: 2024-03-27 to 2039-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-SMIME-v1.1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gsmimercar2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:81:1b:2a:88:2b:8b:93:e9:67:0e:20:85:9a:6b:56
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global SMIME ECC Root CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                01:9F:FA:AC:3E:11:6D:FE:4D:7A:39:12:20:5E:F4:09:85:31:3E:4C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6F4E2464D216A1E0B558BB204259B4A545AEB948957AA3EAF11B2F4DE1AFEF10
    SPKI SHA256: A454645DAC8DE37A799427B6CC411D1ED14C752009928E9F963D20BEC6CCA107
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global SMIME RSA Root CA R1

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME RSA Root CA R1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME RSA Root CA R1
- Serial: 72CB96A233E6F774BCC06400ACD4336C
- SHA-256: F0F255ADA2A643C0A1E7C8F54F3ED3DD25EF0E7378E76F7C127517ECFD952803
- SPKI SHA-256: 30C4B4107B0F945040F4C7179014E5221FA3D5F19FDAD5F41A19A30B921F0210
- Validity: 2024-03-27 to 2039-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-SMIME-v1.1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=182b8855-b43b-49b3-bde1-74cd62e1a554
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gsmimercar1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:cb:96:a2:33:e6:f7:74:bc:c0:64:00:ac:d4:33:6c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global SMIME RSA Root CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2E:7C:23:3E:DD:63:96:A2:44:49:FE:AC:6C:B8:23:88:B8:C8:68:F3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F0F255ADA2A643C0A1E7C8F54F3ED3DD25EF0E7378E76F7C127517ECFD952803
    SPKI SHA256: 30C4B4107B0F945040F4C7179014E5221FA3D5F19FDAD5F41A19A30B921F0210
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global Time Stamping ECC Root CA R2

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping ECC Root CA R2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping ECC Root CA R2
- Serial: 503F2F130EE75CEA850C0C2C7C11E71D
- SHA-256: 90711D905CFF3C773A7320B5188A960C8A7D9E5966FA73284D64A4BF3E2FDA48
- SPKI SHA-256: 65C880E28D265B05BDCEB62032F0E50E03345936CF828E081560D0A09CEC746E
- Validity: 2024-03-27 to 2049-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-CodeSigning-v1.1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtsrcar2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:3f:2f:13:0e:e7:5c:ea:85:0c:0c:2c:7c:11:e7:1d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Time Stamping ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2049 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global Time Stamping ECC Root CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                3E:7B:91:A2:2A:A9:BD:F1:83:F2:D1:AB:57:9C:B9:63:3E:08:AC:85
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 90711D905CFF3C773A7320B5188A960C8A7D9E5966FA73284D64A4BF3E2FDA48
    SPKI SHA256: 65C880E28D265B05BDCEB62032F0E50E03345936CF828E081560D0A09CEC746E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global Time Stamping RSA Root CA R1

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping RSA Root CA R1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping RSA Root CA R1
- Serial: 7EB33AA780D8DABFB4CECCBC36512FB9
- SHA-256: 1759727D9E6679B069DD3AFA910E2779C42007AAB206A169C66E6E2A3D1774B0
- SPKI SHA-256: 2771DD1AE09709C7486FD8595F777DE2A7515165CDE5F2E14A0510E3ADEDEB2A
- Validity: 2024-03-27 to 2049-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-CodeSigning-v1.1.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=97e2e70c-8858-48f2-86db-3512a420cd88
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtsrcar1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:b3:3a:a7:80:d8:da:bf:b4:ce:cc:bc:36:51:2f:b9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Time Stamping RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2049 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global Time Stamping RSA Root CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CD:BF:8A:72:26:F2:CA:5C:32:97:65:78:C5:3E:3E:79:24:6B:EA:6D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1759727D9E6679B069DD3AFA910E2779C42007AAB206A169C66E6E2A3D1774B0
    SPKI SHA256: 2771DD1AE09709C7486FD8595F777DE2A7515165CDE5F2E14A0510E3ADEDEB2A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global TLS ECC Root CA R2

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 6E9FF92AEA0084B6C4643602EE51C03D
- SHA-256: 6C689FC6B014A1FB0CDEB5A3996171C15E7286106028532E0210CEA8D9CD4E97
- SPKI SHA-256: 148250792BA5564CDC393ABEF853DE8693C3ED9A73C09214A3EF43B89290EE31
- Validity: 2024-03-27 to 2039-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6e:9f:f9:2a:ea:00:84:b6:c4:64:36:02:ee:51:c0:3d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6C689FC6B014A1FB0CDEB5A3996171C15E7286106028532E0210CEA8D9CD4E97
    SPKI SHA256: 148250792BA5564CDC393ABEF853DE8693C3ED9A73C09214A3EF43B89290EE31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### UniTrust Global TLS RSA Root CA R1

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 6884AC35D0CDCF15D061144841872735
- SHA-256: 4BABE0E9328D5DAE17936F3DDAA2442BFBDD0873F92FB8D1FBBD3D9894649AD9
- SPKI SHA-256: 23EB05A561E1F54C472CE468568CC5D5AFD4E1FA214C6997F60AC373CE59557A
- Validity: 2024-03-27 to 2039-03-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://assets-cdn.sheca.com/documents/CP-CPS-TLS-v1.4.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=24fb8c97-6794-4ea5-9edf-08bf1d9dfb94, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1f1ac968-90bb-425a-a8d4-9145ce4fbe85, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=f53cdfff-2713-4ae6-9911-188399a81304, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=1fe4900e-4628-4179-84fe-03cc0ed9698f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:84:ac:35:d0:cd:cf:15:d0:61:14:48:41:87:27:35
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4BABE0E9328D5DAE17936F3DDAA2442BFBDD0873F92FB8D1FBBD3D9894649AD9
    SPKI SHA256: 23EB05A561E1F54C472CE468568CC5D5AFD4E1FA214C6997F60AC373CE59557A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### cerschool OV TLS RSA CA G1

- Subject: countryName=CN, organizationName=赛尔教育科技发展有限公司, commonName=cerschool OV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 5BDE28BD20F7019D65578D0F0ADAC2C6
- SHA-256: 04E6B9EAF5EC01A370AD3DFD527E8BB622E3C28C1484EACDB3D2D06DD8F5244E
- SPKI SHA-256: FE1B59798B28F72844E9ED044E0A07BFF25EB3E4CCB180BEDA02CE53964996B8
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/cerschoolovtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:de:28:bd:20:f7:01:9d:65:57:8d:0f:0a:da:c2:c6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = \E8\B5\9B\E5\B0\94\E6\95\99\E8\82\B2\E7\A7\91\E6\8A\80\E5\8F\91\E5\B1\95\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = cerschool OV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                1B:A3:AB:8E:0D:18:EC:EB:A4:D4:93:C5:9E:62:C9:2E:99:59:A0:43
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 04E6B9EAF5EC01A370AD3DFD527E8BB622E3C28C1484EACDB3D2D06DD8F5244E
    SPKI SHA256: FE1B59798B28F72844E9ED044E0A07BFF25EB3E4CCB180BEDA02CE53964996B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CHINA UNICOM DV TLS ECC CA 2026

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM DV TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 1383E2D04FC73E993BC5A6B33AA90DA7
- SHA-256: 6811F3CB2C6D24D32BE074ED6D2288C6546FD179E222E4B948DF20384246982F
- SPKI SHA-256: F8D6F830C036C40FB09C0031269056AB6416A238FF02E44422D0631203602C05
- Validity: 2026-04-26 to 2029-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/cudvtlsecc2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:83:e2:d0:4f:c7:3e:99:3b:c5:a6:b3:3a:a9:0d:a7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CHINA UNICOM DV TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                48:18:49:42:76:43:31:02:3B:23:54:E8:67:C2:22:34:97:C1:FC:3B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.2.156.112570.1.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag21.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6811F3CB2C6D24D32BE074ED6D2288C6546FD179E222E4B948DF20384246982F
    SPKI SHA256: F8D6F830C036C40FB09C0031269056AB6416A238FF02E44422D0631203602C05
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag21.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CHINA UNICOM DV TLS RSA CA 2026

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM DV TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 39B6FED39A6155F96537BC36DC63E367
- SHA-256: 34113CD6536053410ED51951F6C9EBBC85EE47C3D6524F50EF5A671317E46ED6
- SPKI SHA-256: C8C91580B0E90021AA42E3B5850A7C3945114D3A1DE25FA34892ED66F758B681
- Validity: 2026-04-26 to 2029-04-22
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/cudvtlsrsa2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:b6:fe:d3:9a:61:55:f9:65:37:bc:36:dc:63:e3:67
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CHINA UNICOM DV TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                E7:BD:9A:D6:49:F3:A2:96:12:AF:82:02:20:33:6F:A4:C0:22:FB:5C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.2.156.112570.1.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag21.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 34113CD6536053410ED51951F6C9EBBC85EE47C3D6524F50EF5A671317E46ED6
    SPKI SHA256: C8C91580B0E90021AA42E3B5850A7C3945114D3A1DE25FA34892ED66F758B681
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag21.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CHINA UNICOM OV TLS ECC CA 2026

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM OV TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 633F2FB36964E1A518C25E2D4F4469A6
- SHA-256: 8EFB702407B9B2800D68F4456B9ECD6F2807BBE83D46B6D7FFCB9CFF919F0460
- SPKI SHA-256: AFEE160BD220B7D76D7E92137FAECCEB44613BC4F20DCD7D3DF4FBF8CD76D0E3
- Validity: 2026-04-26 to 2029-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/cuovtlsecc2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:3f:2f:b3:69:64:e1:a5:18:c2:5e:2d:4f:44:69:a6
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CHINA UNICOM OV TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                97:A9:F8:E4:50:90:98:C3:CA:E2:C4:BF:AB:04:07:9F:23:0A:A4:6A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.156.112570.1.1.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag22.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8EFB702407B9B2800D68F4456B9ECD6F2807BBE83D46B6D7FFCB9CFF919F0460
    SPKI SHA256: AFEE160BD220B7D76D7E92137FAECCEB44613BC4F20DCD7D3DF4FBF8CD76D0E3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag22.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CHINA UNICOM OV TLS RSA CA 2026

- Subject: countryName=CN, organizationName=联通智慧安全科技有限公司, commonName=CHINA UNICOM OV TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 32867212F58C59D6AFF368D74A25BB5D
- SHA-256: 9F883607914160EB4D2C216D10F9086F1E5B4D0CB215251D0B7E6EA47B9FF3EA
- SPKI SHA-256: D2CBD38DD224F57F8A0A08CB40997CAFB94AE058BEA08E67ABFEDEACA5FA56B9
- Validity: 2026-04-26 to 2029-04-22
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/cuovtlsrsa2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:86:72:12:f5:8c:59:d6:af:f3:68:d7:4a:25:bb:5d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = \E8\81\94\E9\80\9A\E6\99\BA\E6\85\A7\E5\AE\89\E5\85\A8\E7\A7\91\E6\8A\80\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = CHINA UNICOM OV TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                FA:4C:6F:87:6C:50:6C:CC:D5:0A:75:AF:10:8A:F2:A8:0A:86:54:34
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.156.112570.1.1.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag22.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9F883607914160EB4D2C216D10F9086F1E5B4D0CB215251D0B7E6EA47B9FF3EA
    SPKI SHA256: D2CBD38DD224F57F8A0A08CB40997CAFB94AE058BEA08E67ABFEDEACA5FA56B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag22.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CT2 DV TLS RSA CA G1

- Subject: countryName=CN, organizationName=Tianyi Security Technology Co., Ltd., commonName=CT2 DV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 585886012D9277E06C3AA66E15E60659
- SHA-256: 4B316EDFC0780286571E430C0A94231B192B45666AF5DEBEE454FE08E4496383
- SPKI SHA-256: CB501E77C1F175080A2908AE0F0A20979FC1C1C6E6BAE21D2B25A26A137AC441
- Validity: 2024-12-04 to 2034-12-04
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ct2dvtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:58:86:01:2d:92:77:e0:6c:3a:a6:6e:15:e6:06:59
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Dec  4 16:00:00 2024 GMT
            Not After : Dec  4 15:59:59 2034 GMT
        Subject: C = CN, O = "Tianyi Security Technology Co., Ltd.", CN = CT2 DV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                89:55:C1:DB:06:08:F7:A8:3C:51:CA:3B:F9:8F:01:7B:90:09:8A:73
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4B316EDFC0780286571E430C0A94231B192B45666AF5DEBEE454FE08E4496383
    SPKI SHA256: CB501E77C1F175080A2908AE0F0A20979FC1C1C6E6BAE21D2B25A26A137AC441
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CT2 DV TLS RSA CA G2

- Subject: countryName=CN, organizationName=China Telecom Cybersecurity Technology Co.,Ltd., commonName=CT2 DV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 49CBE84DEF17D52237012A6C56A905A8
- SHA-256: 474EE178BCCBDD652115707CDC9251FDF48441C9002229C2AE0DE0E33750FBEA
- SPKI SHA-256: 024FEC19AB41FE45409020F18C0CF5ED86C65A4535E58129707049EB8E8B515F
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ct2dvtlsrsacag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:cb:e8:4d:ef:17:d5:22:37:01:2a:6c:56:a9:05:a8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = "China Telecom Cybersecurity Technology Co.,Ltd.", CN = CT2 DV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                1E:47:BB:AA:FF:F3:BE:4E:D5:23:89:E8:50:9C:34:E9:58:9C:86:9A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 474EE178BCCBDD652115707CDC9251FDF48441C9002229C2AE0DE0E33750FBEA
    SPKI SHA256: 024FEC19AB41FE45409020F18C0CF5ED86C65A4535E58129707049EB8E8B515F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CT2 OV TLS RSA CA G1

- Subject: countryName=CN, organizationName=Tianyi Security Technology Co., Ltd., commonName=CT2 OV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 21F7A8E1B91C9BDF36EB91EBD5E5711D
- SHA-256: A263B7CEFD1490D04FD0EC31D9695BAEE480EE861D12124C2BF8EBD8A893652F
- SPKI SHA-256: 51D8D99E985A67AB60F57717872DEC1806C60E4E7AE585D3CBDACF45FED5E043
- Validity: 2024-12-04 to 2034-12-04
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ct2ovtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:f7:a8:e1:b9:1c:9b:df:36:eb:91:eb:d5:e5:71:1d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Dec  4 16:00:00 2024 GMT
            Not After : Dec  4 15:59:59 2034 GMT
        Subject: C = CN, O = "Tianyi Security Technology Co., Ltd.", CN = CT2 OV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                27:93:7B:F5:74:A8:AF:23:A7:F2:9E:2B:03:CF:AC:C7:18:2B:2E:FA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A263B7CEFD1490D04FD0EC31D9695BAEE480EE861D12124C2BF8EBD8A893652F
    SPKI SHA256: 51D8D99E985A67AB60F57717872DEC1806C60E4E7AE585D3CBDACF45FED5E043
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### CT2 OV TLS RSA CA G2

- Subject: countryName=CN, organizationName=China Telecom Cybersecurity Technology Co.,Ltd., commonName=CT2 OV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 26A524D10C13348CC6C82D1A2CEB903E
- SHA-256: 062884FAEA204C09D10E90FB0069E7BC4E4D93D0316D9F7EFE4E2AFE34226123
- SPKI SHA-256: 06450D1F5FD92DDBF09CBD4444ADA956EF864E6C92972CCC89D73BB970CB2F22
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ct2ovtlsrsacag2.crl, http://crl.global.sheca.com/ct2ovtlsrsacag2.crl/a19646b8/5e83/ad50/ed114c0e/aa9a317cf6c2d657.crl, http://crl.global.sheca.com/ct2ovtlsrsacag2.crl/a19646b8/b01a/08c0/e4c04469/937090a5476449d2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:a5:24:d1:0c:13:34:8c:c6:c8:2d:1a:2c:eb:90:3e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = "China Telecom Cybersecurity Technology Co.,Ltd.", CN = CT2 OV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                E3:9F:B0:A7:34:3D:A2:BF:53:86:20:85:DD:B2:86:4C:B9:8A:13:B2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 062884FAEA204C09D10E90FB0069E7BC4E4D93D0316D9F7EFE4E2AFE34226123
    SPKI SHA256: 06450D1F5FD92DDBF09CBD4444ADA956EF864E6C92972CCC89D73BB970CB2F22
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod DV TLS ECC CA G1

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS ECC CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 7A3D93ABCF46E3499537348A7606A1C9
- SHA-256: AACCD77057271FF5F605DF8CC5A44397E71CCE796EA79B8F1E8658FC9CD52464
- SPKI SHA-256: E6871934521ACBECEEB4E545606838394AC6D71DD36579D1C9B8CEE85AC8B3B1
- Validity: 2025-01-05 to 2035-01-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/dnspoddvtlsecccag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7a:3d:93:ab:cf:46:e3:49:95:37:34:8a:76:06:a1:c9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod DV TLS ECC CA G1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                B9:A7:EB:63:45:AD:B8:89:40:89:2F:8B:69:93:06:58:DA:97:33:CF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AACCD77057271FF5F605DF8CC5A44397E71CCE796EA79B8F1E8658FC9CD52464
    SPKI SHA256: E6871934521ACBECEEB4E545606838394AC6D71DD36579D1C9B8CEE85AC8B3B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod DV TLS RSA CA G1

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 21C0030DA3460E0094DDE70AC04F5973
- SHA-256: A07A7DEFCD1ED23F36D22AC33421F1D973583B12C96CA2496DE724C4494C0CD2
- SPKI SHA-256: 24FC8936AF5A7E2E0AB74A82BA8D5C3EF2D668336C44AEABD6CF68C9D4E14094
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/dnspoddvtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:c0:03:0d:a3:46:0e:00:94:dd:e7:0a:c0:4f:59:73
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod DV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                4C:F1:C7:7B:BB:5F:99:19:23:F8:61:6F:D7:12:F9:74:9C:5A:E5:5C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A07A7DEFCD1ED23F36D22AC33421F1D973583B12C96CA2496DE724C4494C0CD2
    SPKI SHA256: 24FC8936AF5A7E2E0AB74A82BA8D5C3EF2D668336C44AEABD6CF68C9D4E14094
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod OV TLS ECC CA G1

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod OV TLS ECC CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 24775F74463D8AC07211FCD1C2F5ED8D
- SHA-256: 8C4BFF9AE3F079E50208F84E4DA658AB441109686861FFCEE50D4A8662C2EEA1
- SPKI SHA-256: 365381E83DB712750CF9B0AD8BDCF1DEB3C6204985F9A610E430C7AA72DFF0C3
- Validity: 2025-01-05 to 2035-01-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/dnspodovtlsecccag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:77:5f:74:46:3d:8a:c0:72:11:fc:d1:c2:f5:ed:8d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod OV TLS ECC CA G1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                58:6E:A6:57:33:44:3D:CE:3C:ED:5D:EB:F4:7E:00:0F:0E:81:B2:8D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8C4BFF9AE3F079E50208F84E4DA658AB441109686861FFCEE50D4A8662C2EEA1
    SPKI SHA256: 365381E83DB712750CF9B0AD8BDCF1DEB3C6204985F9A610E430C7AA72DFF0C3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod OV TLS RSA CA G1

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod OV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 5F683C19D237A1FAB60C159850C7EAC8
- SHA-256: F36592E33FD869E917E33BADE683A4EC20809D5C8B493A1427BA6DC066CB5AE3
- SPKI SHA-256: 28AD505233D3BA667BB3529AECE9E8E67C96D11B59F56BBA330665F3D599E708
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/dnspodovtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:68:3c:19:d2:37:a1:fa:b6:0c:15:98:50:c7:ea:c8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod OV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                38:C2:2F:B4:85:6A:B8:4A:51:91:1F:E5:3A:7F:E2:BE:11:03:33:8F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F36592E33FD869E917E33BADE683A4EC20809D5C8B493A1427BA6DC066CB5AE3
    SPKI SHA256: 28AD505233D3BA667BB3529AECE9E8E67C96D11B59F56BBA330665F3D599E708
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### HTTPS Automation Research RSA DV SSL CA G1

- Subject: countryName=CN, organizationName=Shenzhen Yamu Security Technology Co., Ltd., commonName=HTTPS Automation Research RSA DV SSL CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 676AE7D79E759F40228E9E6FE5D639D9
- SHA-256: 1E426FF0F51EB4C285788B4418D2DAB21097230CED81119BA178A20AB1AABF67
- SPKI SHA-256: 05A0DF02D4C8A165840740F6E39ED6F2574219AAD7247ED2FFE1136A01C5DBB7
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/har_rsadvsslcag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            67:6a:e7:d7:9e:75:9f:40:22:8e:9e:6f:e5:d6:39:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = "Shenzhen Yamu Security Technology Co., Ltd.", CN = HTTPS Automation Research RSA DV SSL CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                0F:B6:A8:4D:71:E5:B1:B3:8F:9E:72:D6:BB:C0:6A:14:7F:E4:D0:3B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1E426FF0F51EB4C285788B4418D2DAB21097230CED81119BA178A20AB1AABF67
    SPKI SHA256: 05A0DF02D4C8A165840740F6E39ED6F2574219AAD7247ED2FFE1136A01C5DBB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### HUAWEI DV TLS ECC CA 2026

- Subject: countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI DV TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2791F5A5B9D3BC32A9C80ACA6E995345
- SHA-256: 8577470BEBF1D26E4C254AE9B93A06F984EB3778B5FFFA3239F366A274A64D55
- SPKI SHA-256: D36CD3A31063584993E1108797493E0161055FC13C7F90764FD30D64EF04385E
- Validity: 2026-04-26 to 2029-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/hwdvtlsecc2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:91:f5:a5:b9:d3:bc:32:a9:c8:0a:ca:6e:99:53:45
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = "Wuhu Huawei Cloud Computing Technology Co., Ltd.", CN = HUAWEI DV TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                E4:AC:51:FF:72:AA:F5:EE:3E:28:0E:AF:EF:4F:6B:7C:10:1B:B7:E6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.2.156.112570.1.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag21.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8577470BEBF1D26E4C254AE9B93A06F984EB3778B5FFFA3239F366A274A64D55
    SPKI SHA256: D36CD3A31063584993E1108797493E0161055FC13C7F90764FD30D64EF04385E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag21.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### HUAWEI DV TLS RSA CA 2026

- Subject: countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI DV TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 24D505B9DEC66934CB6AC38C2BB0B971
- SHA-256: A0B472CBA2F1C2AFB4A162526E3D14A6475981E84C8E16051B45F43D329C9DE5
- SPKI SHA-256: 20DA6C92EEA07DE59117DF9EC783C1AD815E3BDB4E415E6116CD98678154830B
- Validity: 2026-04-26 to 2029-04-22
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/hwdvtlsrsa2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:d5:05:b9:de:c6:69:34:cb:6a:c3:8c:2b:b0:b9:71
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = "Wuhu Huawei Cloud Computing Technology Co., Ltd.", CN = HUAWEI DV TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                96:C7:87:73:1A:CE:5C:A1:CD:48:87:79:27:7A:C2:F2:E0:66:4F:D7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.2.156.112570.1.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag21.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A0B472CBA2F1C2AFB4A162526E3D14A6475981E84C8E16051B45F43D329C9DE5
    SPKI SHA256: 20DA6C92EEA07DE59117DF9EC783C1AD815E3BDB4E415E6116CD98678154830B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 1.2.156.112570.1.1.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag21.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### HUAWEI OV TLS ECC CA 2026

- Subject: countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI OV TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 6A084098348F953E7E96A0F05F796632
- SHA-256: 6DDEF9228F189B6EEC284AFAC3204B77F0AC9B655BD56571C108E9B70D82385A
- SPKI SHA-256: 5A987B6F9F83B82B046A11A42DFCBCC11A3D97782361785C53C5CEE6ABB54191
- Validity: 2026-04-26 to 2029-04-22
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/hwovtlsecc2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:08:40:98:34:8f:95:3e:7e:96:a0:f0:5f:79:66:32
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = "Wuhu Huawei Cloud Computing Technology Co., Ltd.", CN = HUAWEI OV TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                8F:DA:23:E1:0C:6D:F9:8B:31:14:88:D7:08:EB:D7:1F:86:B2:08:60
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.156.112570.1.1.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag22.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6DDEF9228F189B6EEC284AFAC3204B77F0AC9B655BD56571C108E9B70D82385A
    SPKI SHA256: 5A987B6F9F83B82B046A11A42DFCBCC11A3D97782361785C53C5CEE6ABB54191
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag22.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### HUAWEI OV TLS RSA CA 2026

- Subject: countryName=CN, organizationName=Wuhu Huawei Cloud Computing Technology Co., Ltd., commonName=HUAWEI OV TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 5ADFF526EAA1C3645A76DAA0946489BB
- SHA-256: 070E55A0FCFB5F882D30921125C3B5C3B15DC890E3B08577A69FF264B7B3C4E7
- SPKI SHA-256: 14891966D49CCBB17E470DE0D2AC921B7FC59C0CE6424F99D23ACA24137E7C3C
- Validity: 2026-04-26 to 2029-04-22
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/hwovtlsrsa2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:df:f5:26:ea:a1:c3:64:5a:76:da:a0:94:64:89:bb
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 26 16:00:00 2026 GMT
            Not After : Apr 22 15:59:59 2029 GMT
        Subject: C = CN, O = "Wuhu Huawei Cloud Computing Technology Co., Ltd.", CN = HUAWEI OV TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                07:4B:28:DE:69:72:27:24:E9:27:C8:E8:4E:C3:A3:8C:1A:D4:F1:EF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 1.2.156.112570.1.1.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag22.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 070E55A0FCFB5F882D30921125C3B5C3B15DC890E3B08577A69FF264B7B3C4E7
    SPKI SHA256: 14891966D49CCBB17E470DE0D2AC921B7FC59C0CE6424F99D23ACA24137E7C3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 1.2.156.112570.1.1.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag22.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JoySSL DV Secure Server CA

- Subject: countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL DV Secure Server CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 3FB3952F76817605223A4C483A224520
- SHA-256: 9C6DA141CB394CE6B971A23F988647FF4442E798F0718771B5485A0CC7402335
- SPKI SHA-256: A59147238DB585158EE37CB1F070892E14A8E263A3C2B8DB1670860443742EF1
- Validity: 2024-04-14 to 2034-04-14
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/joyssldvsslca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:b3:95:2f:76:81:76:05:22:3a:4c:48:3a:22:45:20
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 14 16:00:00 2024 GMT
            Not After : Apr 14 15:59:59 2034 GMT
        Subject: C = CN, O = JoySSL Limited, CN = JoySSL DV Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                80:7B:31:18:B8:37:D8:50:FD:1C:4A:D9:87:9A:5E:42:6D:00:A1:A4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9C6DA141CB394CE6B971A23F988647FF4442E798F0718771B5485A0CC7402335
    SPKI SHA256: A59147238DB585158EE37CB1F070892E14A8E263A3C2B8DB1670860443742EF1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JoySSL DV Secure Server CA G1

- Subject: countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL DV Secure Server CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2910290240903309C699A5F574D917D7
- SHA-256: AA9CD0737407E9E9D9D86B145A2CFD7CD385C28BCF5996AA8D9A6DA5FC76F3A2
- SPKI SHA-256: 836262662797C6EE39886D09C1495DEFBB5E75FCACDCC2A998C336A2EBF28512
- Validity: 2024-04-27 to 2034-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/joyssldvsslcag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:10:29:02:40:90:33:09:c6:99:a5:f5:74:d9:17:d7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2024 GMT
            Not After : Apr 27 15:59:59 2034 GMT
        Subject: C = CN, O = JoySSL Limited, CN = JoySSL DV Secure Server CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                2A:56:E8:EF:40:E0:A9:99:9D:6D:D8:12:9F:B7:9B:05:6B:88:2D:ED
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: AA9CD0737407E9E9D9D86B145A2CFD7CD385C28BCF5996AA8D9A6DA5FC76F3A2
    SPKI SHA256: 836262662797C6EE39886D09C1495DEFBB5E75FCACDCC2A998C336A2EBF28512
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JoySSL OV Secure Server CA

- Subject: countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL OV Secure Server CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 7E5B68146682BA0A3342B41DD4FF0B9E
- SHA-256: ACA090CBDBDD35520B22EC3CF7032655BA16A2C800F804B3AAB7F865FA6FC387
- SPKI SHA-256: 8ED5B2F017C5BCB80AAF3B7A98A89A9EA52E6753D729D22F5D9CD29B2AF7FFEC
- Validity: 2024-04-14 to 2034-04-14
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/joyssldovsslca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:5b:68:14:66:82:ba:0a:33:42:b4:1d:d4:ff:0b:9e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 14 16:00:00 2024 GMT
            Not After : Apr 14 15:59:59 2034 GMT
        Subject: C = CN, O = JoySSL Limited, CN = JoySSL OV Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                21:50:7E:50:79:E6:80:B2:02:C0:FB:C1:AF:AD:80:26:DC:52:B8:DD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: ACA090CBDBDD35520B22EC3CF7032655BA16A2C800F804B3AAB7F865FA6FC387
    SPKI SHA256: 8ED5B2F017C5BCB80AAF3B7A98A89A9EA52E6753D729D22F5D9CD29B2AF7FFEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### JoySSL OV Secure Server CA G1

- Subject: countryName=CN, organizationName=JoySSL Limited, commonName=JoySSL OV Secure Server CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 3E2A1CDEED768CD6DD6F7B335AE55BBF
- SHA-256: 0DD33FA366CA02808D29A5C1C456496AB5015C3604EB21C101406AF2533D998A
- SPKI SHA-256: 0E046EE1E045AAD5034CDF94916228C9BBA6FEDE78AC282BBFE53E9515CE441C
- Validity: 2024-04-27 to 2034-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/joysslovsslcag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:2a:1c:de:ed:76:8c:d6:dd:6f:7b:33:5a:e5:5b:bf
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2024 GMT
            Not After : Apr 27 15:59:59 2034 GMT
        Subject: C = CN, O = JoySSL Limited, CN = JoySSL OV Secure Server CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                6B:F2:44:9C:86:D0:C6:DE:D8:51:07:66:1B:27:48:79:23:42:CB:95
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0DD33FA366CA02808D29A5C1C456496AB5015C3604EB21C101406AF2533D998A
    SPKI SHA256: 0E046EE1E045AAD5034CDF94916228C9BBA6FEDE78AC282BBFE53E9515CE441C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KeepTrust DV TLS RSA CA G1

- Subject: countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust DV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 23CCC446921296B35861032AD237B92A
- SHA-256: A879CB01A2661C255B9C2B9BE0B20BA74EEA9546E21A82C570E177CF5BF4AEDA
- SPKI SHA-256: 6CE12399000D2951F45FA2987CF0DF284F381A72C343D38499AF87D80FFDBEC3
- Validity: 2024-04-14 to 2034-04-14
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keeptrustdvtlscag1.crl, http://crl.global.sheca.com/keeptrustdvtlscag1.crl/89ec4353/d274/1285/9b9d4262/9fefa1fbbd5763cf.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:cc:c4:46:92:12:96:b3:58:61:03:2a:d2:37:b9:2a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 14 16:00:00 2024 GMT
            Not After : Apr 14 15:59:59 2034 GMT
        Subject: C = CN, O = Shanghai Huandu Info Tech Co. Ltd., CN = KeepTrust DV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                50:63:44:6A:28:FA:C2:B3:D5:12:2D:01:A6:3D:9B:85:84:50:26:CC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A879CB01A2661C255B9C2B9BE0B20BA74EEA9546E21A82C570E177CF5BF4AEDA
    SPKI SHA256: 6CE12399000D2951F45FA2987CF0DF284F381A72C343D38499AF87D80FFDBEC3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KeepTrust DV TLS RSA CA G2

- Subject: countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust DV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 318D565B3341B3A10820F0BDBE802941
- SHA-256: 352582CCC85B3944E3CD2505D9318F22ABEA418BFF29A0FE4D2C0DF280F200E3
- SPKI SHA-256: 8CEF626A54301D37027277F4364A3E2DAD6DEEF645CF12F95579013A626FEE38
- Validity: 2024-04-27 to 2034-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keeptrustdvtlscag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:8d:56:5b:33:41:b3:a1:08:20:f0:bd:be:80:29:41
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2024 GMT
            Not After : Apr 27 15:59:59 2034 GMT
        Subject: C = CN, O = Shanghai Huandu Info Tech Co. Ltd., CN = KeepTrust DV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                08:8B:0D:F3:0B:09:66:29:70:21:D0:2C:37:73:00:F5:A7:F4:E7:E9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 352582CCC85B3944E3CD2505D9318F22ABEA418BFF29A0FE4D2C0DF280F200E3
    SPKI SHA256: 8CEF626A54301D37027277F4364A3E2DAD6DEEF645CF12F95579013A626FEE38
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KeepTrust OV TLS RSA CA G1

- Subject: countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust OV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 664D5C9AF080BCFA5EC548B9E7760051
- SHA-256: FFD0D9EEEAAFBB4C44F71392F20A52E0F65896854933139640722DECFC2D4658
- SPKI SHA-256: F39709085603D3C3A02FADBB4E425A89195A5E584B1FE5FAF514F7874B847303
- Validity: 2024-04-14 to 2034-04-14
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keeptrustovtlscag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:4d:5c:9a:f0:80:bc:fa:5e:c5:48:b9:e7:76:00:51
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 14 16:00:00 2024 GMT
            Not After : Apr 14 15:59:59 2034 GMT
        Subject: C = CN, O = Shanghai Huandu Info Tech Co. Ltd., CN = KeepTrust OV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                04:FA:1B:9D:BC:05:CD:57:5C:C6:51:8D:5C:DF:E6:2C:D1:51:B0:C8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FFD0D9EEEAAFBB4C44F71392F20A52E0F65896854933139640722DECFC2D4658
    SPKI SHA256: F39709085603D3C3A02FADBB4E425A89195A5E584B1FE5FAF514F7874B847303
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### KeepTrust OV TLS RSA CA G2

- Subject: countryName=CN, organizationName=Shanghai Huandu Info Tech Co. Ltd., commonName=KeepTrust OV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 215BA0EAB80B3194E8449E436488E2B5
- SHA-256: CD50559A6DC5C704237EABF9A070B79F0CDFC1A79C3A6AC8C5E71E295A065D0A
- SPKI SHA-256: 0E1B53CD6652B59B1331334D3BABE8D6E11939DD6CFB2631E0DD4B9FEC386E39
- Validity: 2024-04-27 to 2034-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keeptrustovtlscag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:5b:a0:ea:b8:0b:31:94:e8:44:9e:43:64:88:e2:b5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2024 GMT
            Not After : Apr 27 15:59:59 2034 GMT
        Subject: C = CN, O = Shanghai Huandu Info Tech Co. Ltd., CN = KeepTrust OV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                F6:8D:38:50:B9:6E:A8:BE:FC:50:CA:91:24:7F:1A:BC:9E:A3:9D:4D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CD50559A6DC5C704237EABF9A070B79F0CDFC1A79C3A6AC8C5E71E295A065D0A
    SPKI SHA256: 0E1B53CD6652B59B1331334D3BABE8D6E11939DD6CFB2631E0DD4B9FEC386E39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Keymatic Secure Business ECC CA G1

- Subject: countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Business ECC CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 583020C7226D97F7FCB94AD89E22A3EF
- SHA-256: 75C4AF6628E7D01DD369593EFD727E3560ED9DDD67B04325655821BD23281A2B
- SPKI SHA-256: FC10906C3D8C41B4E9D000F3E14A2675489D6D5F880FA47EC53884639102414F
- Validity: 2025-01-05 to 2035-01-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keymaticovtlsecccag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:30:20:c7:22:6d:97:f7:fc:b9:4a:d8:9e:22:a3:ef
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = PKI(Chongqing) Limited, CN = Keymatic Secure Business ECC CA G1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                23:36:8D:E0:13:A9:BB:36:D7:6A:66:E1:12:8E:DA:5F:4A:36:20:D5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 75C4AF6628E7D01DD369593EFD727E3560ED9DDD67B04325655821BD23281A2B
    SPKI SHA256: FC10906C3D8C41B4E9D000F3E14A2675489D6D5F880FA47EC53884639102414F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Keymatic Secure Business RSA CA G1

- Subject: countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Business RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 252E32EDE48F9B861B7149217348C59E
- SHA-256: 5523644185E21EF943A505A1C438167DA1FE7B14BEF2D243E53DE8C2B4263EB7
- SPKI SHA-256: 2BB21DD9597B3038E39489AC3182750EC7FB6F78851955247979314D51B24FE4
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keymaticovtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            25:2e:32:ed:e4:8f:9b:86:1b:71:49:21:73:48:c5:9e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = PKI(Chongqing) Limited, CN = Keymatic Secure Business RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                56:93:F4:49:C7:E4:48:C3:C3:D2:BE:86:39:7E:33:36:81:63:A3:77
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5523644185E21EF943A505A1C438167DA1FE7B14BEF2D243E53DE8C2B4263EB7
    SPKI SHA256: 2BB21DD9597B3038E39489AC3182750EC7FB6F78851955247979314D51B24FE4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Keymatic Secure Domain ECC CA G1

- Subject: countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Domain ECC CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 6963BC69EC468CDF23EBED1570B1AEB2
- SHA-256: B07D2ACA4F29E2449B5ADB7CCB31C64C43854044A2DAA2AC838788026C684C0C
- SPKI SHA-256: 8F33CDD867B878DA6EE02FE7CE30866F9DF35D04F15DB85E1231B95061AE2BD3
- Validity: 2025-01-05 to 2035-01-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keymaticdvtlsecccag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:63:bc:69:ec:46:8c:df:23:eb:ed:15:70:b1:ae:b2
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = PKI(Chongqing) Limited, CN = Keymatic Secure Domain ECC CA G1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                C1:28:6B:59:0B:19:89:16:D7:76:E6:66:1E:57:D4:46:08:12:ED:DF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B07D2ACA4F29E2449B5ADB7CCB31C64C43854044A2DAA2AC838788026C684C0C
    SPKI SHA256: 8F33CDD867B878DA6EE02FE7CE30866F9DF35D04F15DB85E1231B95061AE2BD3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Keymatic Secure Domain RSA CA G1

- Subject: countryName=CN, organizationName=PKI(Chongqing) Limited, commonName=Keymatic Secure Domain RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2F63AC2CF0329EAE52E2BD197C6B4AFC
- SHA-256: F3C9431A163BECE79562093F0734DF6ED05618551CFEE0ABA949A77E959D8AAE
- SPKI SHA-256: 6B8EBF928134608C7F75B8B15EA3457785FE5F15B3BF9C669FB65A008A4561C2
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/keymaticdvtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:63:ac:2c:f0:32:9e:ae:52:e2:bd:19:7c:6b:4a:fc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = PKI(Chongqing) Limited, CN = Keymatic Secure Domain RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                8E:D0:96:D6:E8:A4:D9:35:F3:86:EB:DA:0B:59:2E:40:52:1B:0C:BB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F3C9431A163BECE79562093F0734DF6ED05618551CFEE0ABA949A77E959D8AAE
    SPKI SHA256: 6B8EBF928134608C7F75B8B15EA3457785FE5F15B3BF9C669FB65A008A4561C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SanFront DV TLS RSA CA G1

- Subject: countryName=CN, organizationName=北京中科三方网络技术有限公司, commonName=SanFront DV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 3B1C3E2042FDF2C6140E278B336259AB
- SHA-256: 7D7702A277CFEBC283F6F24A2C17CA0EBA7600096105244AD1913E7BE2E56A29
- SPKI SHA-256: 74BED6423516E4C651A5CDC5D22C5DE23740867A905687C949F8444B0512C38F
- Validity: 2025-09-17 to 2030-09-17
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/sanfrontdvg1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:1c:3e:20:42:fd:f2:c6:14:0e:27:8b:33:62:59:ab
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Sep 17 16:00:00 2025 GMT
            Not After : Sep 17 15:59:59 2030 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E4\B8\AD\E7\A7\91\E4\B8\89\E6\96\B9\E7\BD\91\E7\BB\9C\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = SanFront DV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                22:03:36:E7:51:53:02:E6:CD:FA:99:C5:17:32:DA:4F:CE:34:A0:96
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7D7702A277CFEBC283F6F24A2C17CA0EBA7600096105244AD1913E7BE2E56A29
    SPKI SHA256: 74BED6423516E4C651A5CDC5D22C5DE23740867A905687C949F8444B0512C38F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SanFront DV TLS RSA CA G2

- Subject: countryName=CN, organizationName=北京国科云计算技术有限公司, commonName=SanFront DV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 27EB06266CD5267D5367B8595E81AB00
- SHA-256: 7C7DA4E281AF24FEF35A6711ECA55DBFF1C6333709DFC679470F325D1CBD9460
- SPKI SHA-256: 391F7590023FE0E4F1B9D6385A5E02FAE5E28592790E119844D03E4FA1394F0F
- Validity: 2025-11-11 to 2030-11-11
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/sanfrontdvg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:eb:06:26:6c:d5:26:7d:53:67:b8:59:5e:81:ab:00
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Nov 11 16:00:00 2025 GMT
            Not After : Nov 11 15:59:59 2030 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E5\9B\BD\E7\A7\91\E4\BA\91\E8\AE\A1\E7\AE\97\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = SanFront DV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                A0:75:64:20:65:B8:7E:1C:37:C5:64:AD:43:A4:D5:4F:24:29:34:D8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7C7DA4E281AF24FEF35A6711ECA55DBFF1C6333709DFC679470F325D1CBD9460
    SPKI SHA256: 391F7590023FE0E4F1B9D6385A5E02FAE5E28592790E119844D03E4FA1394F0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SanFront OV TLS RSA CA G1

- Subject: countryName=CN, organizationName=北京中科三方网络技术有限公司, commonName=SanFront OV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 325CDC688D18AD0DE6CE63F5CC1C765C
- SHA-256: E1C893A5658D63E2BA78CAFF160B81F9836B6A851F1A3CAA48B3B4E287F0092F
- SPKI SHA-256: 44B7DDE8C2F2B3C5821AE26E60B6391822FAB3A4C5DA47686C12BF1988AB04B6
- Validity: 2025-09-17 to 2030-09-17
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/sanfrontovg1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            32:5c:dc:68:8d:18:ad:0d:e6:ce:63:f5:cc:1c:76:5c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Sep 17 16:00:00 2025 GMT
            Not After : Sep 17 15:59:59 2030 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E4\B8\AD\E7\A7\91\E4\B8\89\E6\96\B9\E7\BD\91\E7\BB\9C\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = SanFront OV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                43:58:D1:5F:52:55:B6:0A:7C:0D:AB:FE:9A:FA:C9:08:82:AC:F4:74
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E1C893A5658D63E2BA78CAFF160B81F9836B6A851F1A3CAA48B3B4E287F0092F
    SPKI SHA256: 44B7DDE8C2F2B3C5821AE26E60B6391822FAB3A4C5DA47686C12BF1988AB04B6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SanFront OV TLS RSA CA G2

- Subject: countryName=CN, organizationName=北京国科云计算技术有限公司, commonName=SanFront OV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 43F9B5129ABD67C37D90999663CE0C7E
- SHA-256: 37A7BCAF399CA6C24F3ABB6E0AF9DDE32AEEEBA1D36AECC958C7631609FE01A9
- SPKI SHA-256: D8D2DBEB714256E272B46B44825692BEF2D8F83CAD9BAEBEB80FB9851ABC6F11
- Validity: 2025-11-11 to 2030-11-11
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/sanfrontovg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:f9:b5:12:9a:bd:67:c3:7d:90:99:96:63:ce:0c:7e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Nov 11 16:00:00 2025 GMT
            Not After : Nov 11 15:59:59 2030 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E5\9B\BD\E7\A7\91\E4\BA\91\E8\AE\A1\E7\AE\97\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = SanFront OV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                CD:85:D5:F9:7A:4F:8B:ED:4C:E3:E1:71:36:97:21:B7:3D:77:D0:1B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 37A7BCAF399CA6C24F3ABB6E0AF9DDE32AEEEBA1D36AECC958C7631609FE01A9
    SPKI SHA256: D8D2DBEB714256E272B46B44825692BEF2D8F83CAD9BAEBEB80FB9851ABC6F11
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Code Signing CA G4

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Code Signing CA G4
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 4C8B674388B0CE0BE02B9B425E089272
- SHA-256: 8F0C3E06A16E3EA7C9B15A848076ED15E51DA0B6F1AFA274EDE2B9102191FE0F
- SPKI SHA-256: BA9A0303E2306C780145BC19A49327EF3038BC8BB3D598EF7891C04768723937
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:8b:67:43:88:b0:ce:0b:e0:2b:9b:42:5e:08:92:72
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Code Signing CA G4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                73:C3:B3:90:21:CB:F2:3B:DA:23:D3:51:F2:95:C5:8B:C6:78:EE:47
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F0C3E06A16E3EA7C9B15A848076ED15E51DA0B6F1AFA274EDE2B9102191FE0F
    SPKI SHA256: BA9A0303E2306C780145BC19A49327EF3038BC8BB3D598EF7891C04768723937
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Code Signing ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Code Signing ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing ECC Root CA R2
- Serial: 33154431B28301EE37A9391D344137C7
- SHA-256: 953707AE07AF34970462E8C02AC3D10949D3684D063385277F31869508007D23
- SPKI SHA-256: 0F00BF1B5FD63049262BD1A4E900EB84B904D0811233E472A6DE121CA676A2D4
- Validity: 2024-03-27 to 2039-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar2
- CRL DP: http://crl.global.sheca.com/root/gcsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:15:44:31:b2:83:01:ee:37:a9:39:1d:34:41:37:c7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Code Signing ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Code Signing ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                AE:58:28:DA:2C:5C:A1:3B:20:03:6F:30:8B:B8:11:12:E5:2C:2A:BA
            X509v3 Subject Key Identifier:
                30:26:8A:35:85:38:1C:0E:A9:2D:90:ED:94:93:65:E7:89:EB:26:7E
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gcsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gcsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gcsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 953707AE07AF34970462E8C02AC3D10949D3684D063385277F31869508007D23
    SPKI SHA256: 0F00BF1B5FD63049262BD1A4E900EB84B904D0811233E472A6DE121CA676A2D4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gcsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gcsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Code Signing RSA CA 1B

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Code Signing RSA CA 1B
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing RSA Root CA R1
- Serial: 146F278E434B4F4C14D9691B49A56349
- SHA-256: 4C5F7C561295B97FE7616389A2B549A0D4598D0BD15EBFEA53AB518714CB8434
- SPKI SHA-256: 80F55C9E72CB756CDBD6CA0CE45CD031C84A4F52564FFDE767C0E8EA981ABC71
- Validity: 2024-05-27 to 2039-05-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar1
- CRL DP: http://crl.global.sheca.com/root/gcsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:6f:27:8e:43:4b:4f:4c:14:d9:69:1b:49:a5:63:49
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Code Signing RSA Root CA R1
        Validity
            Not Before: May 27 16:00:00 2024 GMT
            Not After : May 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Code Signing RSA CA 1B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                06:7A:4B:64:AE:B4:0D:BD:40:08:29:22:7D:41:EB:11:5F:5D:1A:B6
            X509v3 Subject Key Identifier:
                04:6D:ED:1C:4A:44:C8:27:55:8C:D1:7D:7B:17:CC:0C:53:95:79:DE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gcsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gcsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gcsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 4C5F7C561295B97FE7616389A2B549A0D4598D0BD15EBFEA53AB518714CB8434
    SPKI SHA256: 80F55C9E72CB756CDBD6CA0CE45CD031C84A4F52564FFDE767C0E8EA981ABC71
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gcsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gcsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV Server CA G5

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV Server CA G5
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 4F018A82E892DF23680C93968438C0F5
- SHA-256: 778C516DAEC700EE58B3581E411E5C0DD478663A5163A29895341507D6E964DD
- SPKI SHA-256: 2D2BFC074D27D2B0F035A8A8233D2A2209C2F49ED89122BD352DF9A958D564AE
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/dvscag5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:01:8a:82:e8:92:df:23:68:0c:93:96:84:38:c0:f5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV Server CA G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                D8:E7:06:1B:64:5F:AB:30:08:88:7A:24:53:AA:E1:1C:83:04:BF:6D
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 778C516DAEC700EE58B3581E411E5C0DD478663A5163A29895341507D6E964DD
    SPKI SHA256: 2D2BFC074D27D2B0F035A8A8233D2A2209C2F49ED89122BD352DF9A958D564AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV TLS ECC CA 2026 S1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS ECC CA 2026 S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 7B4DA7A9B60761FFE47F3A4D04621093
- SHA-256: 82CC3368931DFC9ECB3927EBBDACFA04366DD43D81F1343FEB61BB8E59E6EBD6
- SPKI SHA-256: 77271F31570130FAC5D809F4728827044529ACACDB3CC5CB4526A7CF952A105B
- Validity: 2026-02-08 to 2029-02-04
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gdvtlsecc2026s1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:4d:a7:a9:b6:07:61:ff:e4:7f:3a:4d:04:62:10:93
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Feb  8 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV TLS ECC CA 2026 S1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Subject Key Identifier:
                6C:1E:51:09:B5:F0:91:FE:E7:0F:96:4C:C3:66:45:2F:0C:12:31:FC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 82CC3368931DFC9ECB3927EBBDACFA04366DD43D81F1343FEB61BB8E59E6EBD6
    SPKI SHA256: 77271F31570130FAC5D809F4728827044529ACACDB3CC5CB4526A7CF952A105B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV TLS ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 7753CB808BA3BCC0D952EF0248DF29D7
- SHA-256: D690D8722EA89CD7617901449520653339386AC4939F7EC5C1B195D9C3C95FA4
- SPKI SHA-256: BB957F7C1F0FF3D94869D6EB1CE6D9C42BDE1EA1C7E01E1552ECF67FF9404C68
- Validity: 2024-03-27 to 2029-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gdvtlsca2a.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:53:cb:80:8b:a3:bc:c0:d9:52:ef:02:48:df:29:d7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV TLS ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Subject Key Identifier:
                DB:6A:AF:EC:B4:74:11:9D:57:B1:CF:3B:AE:AC:84:3E:6C:9B:C4:86
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D690D8722EA89CD7617901449520653339386AC4939F7EC5C1B195D9C3C95FA4
    SPKI SHA256: BB957F7C1F0FF3D94869D6EB1CE6D9C42BDE1EA1C7E01E1552ECF67FF9404C68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV TLS ECC CA G6

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS ECC CA G6
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 531E839D1EF8EB1D91B880A25EDCC1A7
- SHA-256: 1F0570E418F9C89E094CB26EDA71B92BED81ACBB446B2300D398DDB739AB7A6C
- SPKI SHA-256: 14B326E21493A70C1F5A910C6C9C28F388DFB72BF03473BDB3645578A9553F19
- Validity: 2024-12-04 to 2034-12-04
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gdvtlscag6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:1e:83:9d:1e:f8:eb:1d:91:b8:80:a2:5e:dc:c1:a7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Dec  4 16:00:00 2024 GMT
            Not After : Dec  4 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV TLS ECC CA G6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                7E:44:A7:C6:21:F5:F3:0E:25:29:3C:07:F2:88:EC:C8:2F:7B:D4:82
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1F0570E418F9C89E094CB26EDA71B92BED81ACBB446B2300D398DDB739AB7A6C
    SPKI SHA256: 14B326E21493A70C1F5A910C6C9C28F388DFB72BF03473BDB3645578A9553F19
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV TLS RSA CA 1A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS RSA CA 1A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 6A5EF7E55BE2507E107547B24FDC4350
- SHA-256: FFABEA74895DC0C78C224597472CF6937E0D740EF49DC2256C8E75A2A2A15EDE
- SPKI SHA-256: CA39682AA2BE351E9D613613D47BF2F0362DDD1843F23D65389881EE6EC35E5B
- Validity: 2024-03-27 to 2029-03-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gdvtlsca1a.crl, http://crl.global.sheca.com/gdvtlsca1a.crl/7fbf4f73/550b/3c29/81094ffc/84bf0f99e3a9d363.crl, http://crl.global.sheca.com/gdvtlsca1a.crl/7fbf4f73/0cea/17c7/a78e4e19/8d0316ec665814c0.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:5e:f7:e5:5b:e2:50:7e:10:75:47:b2:4f:dc:43:50
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV TLS RSA CA 1A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Subject Key Identifier:
                92:91:7E:0B:CF:0C:5C:10:8A:B5:94:4E:42:0C:56:10:42:A4:49:EB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FFABEA74895DC0C78C224597472CF6937E0D740EF49DC2256C8E75A2A2A15EDE
    SPKI SHA256: CA39682AA2BE351E9D613613D47BF2F0362DDD1843F23D65389881EE6EC35E5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV TLS RSA CA 2026 S1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS RSA CA 2026 S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 312BFCF08CFA1C9A57354DAD001F22BA
- SHA-256: B2292E872A1D842781A4820BDC1F65B83378A5A43ADA17D6162FB81DCD661C13
- SPKI SHA-256: C857804C814B017C7BBA3B3D5B4B1C2006928E08566FA3C307D7C664663A406E
- Validity: 2026-02-08 to 2029-02-04
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gdvtlsrsa2026s1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:2b:fc:f0:8c:fa:1c:9a:57:35:4d:ad:00:1f:22:ba
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Feb  8 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV TLS RSA CA 2026 S1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Subject Key Identifier:
                3C:A7:BD:49:C2:02:F6:17:A5:95:A6:5C:4E:73:26:74:16:CD:76:24
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B2292E872A1D842781A4820BDC1F65B83378A5A43ADA17D6162FB81DCD661C13
    SPKI SHA256: C857804C814B017C7BBA3B3D5B4B1C2006928E08566FA3C307D7C664663A406E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA DV TLS RSA CA A1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA DV TLS RSA CA A1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 41DFB24AFC6453C6B8B9644DC87FAA0A
- SHA-256: 7CD13B8B9E51BD6EAE0116D7F89E3F21EAA3ABA2A20997B2606A3DCC578E7295
- SPKI SHA-256: 61B678EFCE55582F114324C2F1A53753C04746D2B489FE3ADC84FBAF14D9244C
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gdvtlscaa1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:df:b2:4a:fc:64:53:c6:b8:b9:64:4d:c8:7f:aa:0a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA DV TLS RSA CA A1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                A4:43:6E:E2:78:86:BC:D3:D2:9B:43:06:B1:E6:05:AC:26:4F:F4:71
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7CD13B8B9E51BD6EAE0116D7F89E3F21EAA3ABA2A20997B2606A3DCC578E7295
    SPKI SHA256: 61B678EFCE55582F114324C2F1A53753C04746D2B489FE3ADC84FBAF14D9244C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV Code Signing CA G2

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 6A863D54E5B4604879AFE6E73A96C72B
- SHA-256: DD84169585A2E7A216AECD4083265A8EB51A64F7C6F1943671F8584C73F79A74
- SPKI SHA-256: D6115D674A49EBD4C445238CFE001211E4A61E2CD16165B5838B73B642D01828
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/evcscag2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- CRL DP: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:86:3d:54:e5:b4:60:48:79:af:e6:e7:3a:96:c7:2b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV Code Signing CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evg1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evg1
                CA Issuers - URI:http://certs.global.sheca.com/evg1.cer
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Subject Key Identifier:
                50:07:CC:4D:F6:F4:BA:37:FC:13:CE:1F:2D:22:C9:56:D8:9E:A5:03
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.3
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DD84169585A2E7A216AECD4083265A8EB51A64F7C6F1943671F8584C73F79A74
    SPKI SHA256: D6115D674A49EBD4C445238CFE001211E4A61E2CD16165B5838B73B642D01828
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- AIA CA Issuers: http://certs.global.sheca.com/evg1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV Code Signing CA G3

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing CA G3
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 37A8E0FDFC6B4652AEE3DE63A4840386
- SHA-256: E00AC33AC715D8BC3B6607A4165AE8428F9274B4224AB3D8CF36E8C8D62834A3
- SPKI SHA-256: 41B8CAC4145AC11AA5984A28A0C4D21C2584060FCAB6D42B07B2FCA37638F48D
- Validity: 2024-05-27 to 2039-05-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevcscag3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- CRL DP: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            37:a8:e0:fd:fc:6b:46:52:ae:e3:de:63:a4:84:03:86
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: May 27 16:00:00 2024 GMT
            Not After : May 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV Code Signing CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Subject Key Identifier:
                6D:32:5F:A7:4C:C0:EE:C8:9B:7C:6A:3C:0F:2E:33:CA:55:EB:99:A8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evg1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evg1
                CA Issuers - URI:http://certs.global.sheca.com/evg1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E00AC33AC715D8BC3B6607A4165AE8428F9274B4224AB3D8CF36E8C8D62834A3
    SPKI SHA256: 41B8CAC4145AC11AA5984A28A0C4D21C2584060FCAB6D42B07B2FCA37638F48D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- AIA CA Issuers: http://certs.global.sheca.com/evg1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV Code Signing ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing ECC Root CA R2
- Serial: 74A4A3E76514AE868457E4A69E30E027
- SHA-256: 545BD126658352B306EE74185173F1774A79467A26E9BB6AE0ED44D86615DE5A
- SPKI SHA-256: 159425CE4132E80C07CE0A5817359DD068C149D24EA7C99445B0E96F13E08B28
- Validity: 2024-03-27 to 2039-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar2
- CRL DP: http://crl.global.sheca.com/root/gcsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:a4:a3:e7:65:14:ae:86:84:57:e4:a6:9e:30:e0:27
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Code Signing ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV Code Signing ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                AE:58:28:DA:2C:5C:A1:3B:20:03:6F:30:8B:B8:11:12:E5:2C:2A:BA
            X509v3 Subject Key Identifier:
                17:58:8C:CB:8D:CA:31:FF:1F:A5:08:4A:3F:39:48:92:16:F7:D6:6F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gcsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gcsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gcsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 545BD126658352B306EE74185173F1774A79467A26E9BB6AE0ED44D86615DE5A
    SPKI SHA256: 159425CE4132E80C07CE0A5817359DD068C149D24EA7C99445B0E96F13E08B28
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gcsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gcsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV Code Signing RSA CA 1B

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV Code Signing RSA CA 1B
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Code Signing RSA Root CA R1
- Serial: 246C264503A6C513EC9CBE28D4CA9296
- SHA-256: A85CBD3FD9F3BFE220DE0A09B52D5AA6F627EE9297FEFCE8706073A41B993C79
- SPKI SHA-256: B8562CDF69644388190D83C677A1E43C69802E6F81EDBF8F6F31AD172D23F8BD
- Validity: 2024-05-27 to 2039-05-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar1
- CRL DP: http://crl.global.sheca.com/root/gcsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:6c:26:45:03:a6:c5:13:ec:9c:be:28:d4:ca:92:96
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Code Signing RSA Root CA R1
        Validity
            Not Before: May 27 16:00:00 2024 GMT
            Not After : May 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV Code Signing RSA CA 1B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                06:7A:4B:64:AE:B4:0D:BD:40:08:29:22:7D:41:EB:11:5F:5D:1A:B6
            X509v3 Subject Key Identifier:
                7E:25:61:77:16:72:AE:E0:63:F1:C0:7B:7C:AC:6F:3A:AE:44:CD:C3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gcsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gcsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gcsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A85CBD3FD9F3BFE220DE0A09B52D5AA6F627EE9297FEFCE8706073A41B993C79
    SPKI SHA256: B8562CDF69644388190D83C677A1E43C69802E6F81EDBF8F6F31AD172D23F8BD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 2.23.140.1.3
- AIA OCSP: http://ocsp.global.sheca.com/gcsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gcsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gcsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV Server CA G2

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV Server CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 794519DDA0F124C48E1B3EAF9638C891
- SHA-256: 4216527163AD2CAA825D3BF48F61A7661D0ABC89B58AB76B23A1E10999F0769F
- SPKI SHA-256: 6D4A5C9E673826992C3251A522BD564B12DBF3140B8ABEC8069CCF9BF38D1FC2
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/evscag2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:45:19:dd:a0:f1:24:c4:8e:1b:3e:af:96:38:c8:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV Server CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                86:B1:48:C0:42:0A:9C:6F:81:FC:4F:DC:D1:0F:18:4B:AA:B5:A6:EA
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4216527163AD2CAA825D3BF48F61A7661D0ABC89B58AB76B23A1E10999F0769F
    SPKI SHA256: 6D4A5C9E673826992C3251A522BD564B12DBF3140B8ABEC8069CCF9BF38D1FC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV Server CA G3

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV Server CA G3
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 54A4F470BE2317F511B5C0A28D9E9440
- SHA-256: 7EF3F89456CE636557B20C5DFB37F98C253A0B660D2E9E5E7845CAF9C038C7C1
- SPKI SHA-256: 6BF799C9D2BB4CF702E9541416FFDE93C1A8725A62A7C1C8405DE2C810B5BFD6
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/evscag3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- CRL DP: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:a4:f4:70:be:23:17:f5:11:b5:c0:a2:8d:9e:94:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV Server CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evg1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evg1
                CA Issuers - URI:http://certs.global.sheca.com/evg1.cer
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Subject Key Identifier:
                54:E9:72:FB:78:66:9F:E5:CB:F3:3B:8F:98:46:55:53:73:9C:0B:84
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7EF3F89456CE636557B20C5DFB37F98C253A0B660D2E9E5E7845CAF9C038C7C1
    SPKI SHA256: 6BF799C9D2BB4CF702E9541416FFDE93C1A8725A62A7C1C8405DE2C810B5BFD6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- AIA CA Issuers: http://certs.global.sheca.com/evg1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV TLS ECC CA 2026 S1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS ECC CA 2026 S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 1128543CB52FE838894516216C4D1BB0
- SHA-256: 2C0B55DF3E6F26B4133CD04AE7B7A62F1DCEFD4C27E7D73A30CB25D914786E98
- SPKI SHA-256: 6269199E02E013AE3848BDC7FFB9E446143B4FEC4BB17CF966D5DB9344A4AFC7
- Validity: 2026-02-08 to 2029-02-04
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevtlsecc2026s1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:28:54:3c:b5:2f:e8:38:89:45:16:21:6c:4d:1b:b0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Feb  8 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV TLS ECC CA 2026 S1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Subject Key Identifier:
                C1:BA:AF:0B:91:C9:D8:C7:86:E1:4C:72:2B:96:5C:E2:27:2E:1B:9D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2C0B55DF3E6F26B4133CD04AE7B7A62F1DCEFD4C27E7D73A30CB25D914786E98
    SPKI SHA256: 6269199E02E013AE3848BDC7FFB9E446143B4FEC4BB17CF966D5DB9344A4AFC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV TLS ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 5FE08EE145771C42C9ADD82839EAA83E
- SHA-256: 05E4C4B1F258030690E6793C9C13C6F6AE234F68E5C41236FDC919B7F589032F
- SPKI SHA-256: ABC47148997A5FD76F5DDBFDE3E6901213E60E0634E207E6DFD6FDC57C866956
- Validity: 2024-03-27 to 2029-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevtlsca2a.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:e0:8e:e1:45:77:1c:42:c9:ad:d8:28:39:ea:a8:3e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV TLS ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Subject Key Identifier:
                6D:B0:5C:0F:E4:06:6E:45:64:31:47:10:6E:A3:F2:03:27:D3:AC:BC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 05E4C4B1F258030690E6793C9C13C6F6AE234F68E5C41236FDC919B7F589032F
    SPKI SHA256: ABC47148997A5FD76F5DDBFDE3E6901213E60E0634E207E6DFD6FDC57C866956
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV TLS ECC CA C2

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS ECC CA C2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 281718F446FB83E0523B3BFE494C8703
- SHA-256: E3BF9CA7BC56D03EE6BAE52E3FBA47CAFE4198F2A026C8278087D82B951E428C
- SPKI SHA-256: 4794DBCAD5E4C61819B19F8EE239F08A14981846FE9497319A7249CEE6EB163A
- Validity: 2025-04-27 to 2035-04-27
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevtlscac2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evrcag1
- CRL DP: http://crl.global.sheca.com/root/evrcag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            28:17:18:f4:46:fb:83:e0:52:3b:3b:fe:49:4c:87:03
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV TLS ECC CA C2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Subject Key Identifier:
                AE:AF:D7:E1:68:00:07:D1:87:53:57:88:3E:DD:F2:98:E3:C8:98:3C
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evrcag1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evrcag1
                CA Issuers - URI:http://certs.global.sheca.com/evrcag1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E3BF9CA7BC56D03EE6BAE52E3FBA47CAFE4198F2A026C8278087D82B951E428C
    SPKI SHA256: 4794DBCAD5E4C61819B19F8EE239F08A14981846FE9497319A7249CEE6EB163A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/evrcag1
- AIA CA Issuers: http://certs.global.sheca.com/evrcag1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evrcag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV TLS RSA CA 1A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS RSA CA 1A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 473ED069405C461D3FC9CD812E9220E9
- SHA-256: B2525A5966CA68CA7F504F0A21FD73847D174F89B48852A3E970588E1EAFC774
- SPKI SHA-256: E9CDE2C10A158D7FD03F68BD9788E673ABCA38992DA5F5046F4B87B8DB5B9C6F
- Validity: 2024-03-27 to 2029-03-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevtlsca1a.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:3e:d0:69:40:5c:46:1d:3f:c9:cd:81:2e:92:20:e9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV TLS RSA CA 1A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Subject Key Identifier:
                40:5C:00:0B:86:46:20:82:A0:BF:B2:C6:00:63:41:03:65:66:2F:04
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B2525A5966CA68CA7F504F0A21FD73847D174F89B48852A3E970588E1EAFC774
    SPKI SHA256: E9CDE2C10A158D7FD03F68BD9788E673ABCA38992DA5F5046F4B87B8DB5B9C6F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV TLS RSA CA 2026 S1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS RSA CA 2026 S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 53E77EA7D6D99E94AF2C9C86D459D677
- SHA-256: B0CBFA69D8D4F658CF761C2B0CF73B84A90022EF5B977B13E06EC42B913DE1F1
- SPKI SHA-256: 31E5881A4755F5D64D1A620876706A8386F82A42A298555E35EE43EA1BE071A8
- Validity: 2026-02-08 to 2029-02-04
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevtlsrsa2026s1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:e7:7e:a7:d6:d9:9e:94:af:2c:9c:86:d4:59:d6:77
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Feb  8 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV TLS RSA CA 2026 S1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Subject Key Identifier:
                19:7C:4F:E5:F5:8C:6B:FD:7E:EB:9A:A0:2D:1E:78:44:4C:F1:FF:F7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B0CBFA69D8D4F658CF761C2B0CF73B84A90022EF5B977B13E06EC42B913DE1F1
    SPKI SHA256: 31E5881A4755F5D64D1A620876706A8386F82A42A298555E35EE43EA1BE071A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA EV TLS RSA CA C1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA EV TLS RSA CA C1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 70094F1E2FEC189816A446D5476CB3B8
- SHA-256: 15F4F5D5A8D6DED4CDD54CE4E1B367203B7F2CDF416104BA5D6405AF55AC8045
- SPKI SHA-256: FD3665C1E32B9E55A56DEF5B582DDBC584057A97A027C59FB1991FC807B7CD3A
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gevtlscac1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evrcag1
- CRL DP: http://crl.global.sheca.com/root/evrcag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:09:4f:1e:2f:ec:18:98:16:a4:46:d5:47:6c:b3:b8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA EV TLS RSA CA C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Subject Key Identifier:
                8A:4E:9A:2D:57:D5:07:31:37:5F:E5:B8:51:07:89:63:0B:80:48:77
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evrcag1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evrcag1
                CA Issuers - URI:http://certs.global.sheca.com/evrcag1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 15F4F5D5A8D6DED4CDD54CE4E1B367203B7F2CDF416104BA5D6405AF55AC8045
    SPKI SHA256: FD3665C1E32B9E55A56DEF5B582DDBC584057A97A027C59FB1991FC807B7CD3A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.3, 2.23.140.1.1
- AIA OCSP: http://ocsp.global.sheca.com/evrcag1
- AIA CA Issuers: http://certs.global.sheca.com/evrcag1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evrcag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Extended Validation Code Signing CA

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Extended Validation Code Signing CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 59F19A2DEAED848C4AD7D3904CB5065A
- SHA-256: A392C645B9A5AD6A214F19DE776346BC7DD6BB15818E433886DAC54EE6661852
- SPKI SHA-256: B9CCD00C9A98944E8945836E79AF982D801FCC510F3E3CEBD74E50326D7019FA
- Validity: 2015-03-13 to 2030-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/evroot/ev.ocsp
- CRL DP: http://ldap2.sheca.com/root/ucaevsub.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:f1:9a:2d:ea:ed:84:8c:4a:d7:d3:90:4c:b5:06:5a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Mar 13 00:00:00 2015 GMT
            Not After : Dec 31 00:00:00 2030 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Extended Validation Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.sheca.com/policy/
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/evroot/ev.ocsp
                CA Issuers - URI:http://ldap2.sheca.com/root/ucaevroot.der
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                74:98:99:6F:6A:15:C0:06:25:20:85:1C:AF:2B:31:6B:87:ED:A3:DB
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/ucaevsub.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A392C645B9A5AD6A214F19DE776346BC7DD6BB15818E433886DAC54EE6661852
    SPKI SHA256: B9CCD00C9A98944E8945836E79AF982D801FCC510F3E3CEBD74E50326D7019FA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/evroot/ev.ocsp
- AIA CA Issuers: http://ldap2.sheca.com/root/ucaevroot.der
- CRL Distribution Points: http://ldap2.sheca.com/root/ucaevsub.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Extended Validation SSL CA

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Extended Validation SSL CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 4D8BA7B4DF9E1153E1C80DEE3E6F409A
- SHA-256: 25BFDB1C5FE2CCE051EC6DFBF2BB24E78C92F969B1BB37867DAEDF93D1A7AE7E
- SPKI SHA-256: 275B230926E1A6CE17D70369B7852114307CCBF31C40F9CC6B74BEB04E2AD2ED
- Validity: 2015-03-13 to 2030-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/evssl-1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/evroot/ev.ocsp
- CRL DP: http://ldap2.sheca.com/root/ucaevsub.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:8b:a7:b4:df:9e:11:53:e1:c8:0d:ee:3e:6f:40:9a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Mar 13 00:00:00 2015 GMT
            Not After : Dec 31 00:00:00 2030 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Extended Validation SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.sheca.com/policy/
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/evroot/ev.ocsp
                CA Issuers - URI:http://ldap2.sheca.com/root/ucaevroot.der
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                4D:14:0D:EA:6B:55:9C:0C:A6:E1:BB:7B:E8:6A:96:6D:17:5E:7C:B5
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/ucaevsub.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 25BFDB1C5FE2CCE051EC6DFBF2BB24E78C92F969B1BB37867DAEDF93D1A7AE7E
    SPKI SHA256: 275B230926E1A6CE17D70369B7852114307CCBF31C40F9CC6B74BEB04E2AD2ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/evroot/ev.ocsp
- AIA CA Issuers: http://ldap2.sheca.com/root/ucaevroot.der
- CRL Distribution Points: http://ldap2.sheca.com/root/ucaevsub.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA FREE DV TLS ECC CA G2

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA FREE DV TLS ECC CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 7C69AA6E819102D352E3CC6DC1B05562
- SHA-256: 81DB88F4CDE7345B0EC140E4A193720163DF9B787FABA0AF5A7EDACE6DC315A6
- SPKI SHA-256: BE27355F9156FB764BD7096659B419F3B774ADC77D13D605E644ABD5C22FAE80
- Validity: 2024-12-04 to 2034-12-04
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gfreedvtlscag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7c:69:aa:6e:81:91:02:d3:52:e3:cc:6d:c1:b0:55:62
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Dec  4 16:00:00 2024 GMT
            Not After : Dec  4 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA FREE DV TLS ECC CA G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                84:BC:FE:29:59:4A:85:C0:84:9F:F0:F2:12:30:81:2B:E7:3F:9B:BC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 81DB88F4CDE7345B0EC140E4A193720163DF9B787FABA0AF5A7EDACE6DC315A6
    SPKI SHA256: BE27355F9156FB764BD7096659B419F3B774ADC77D13D605E644ABD5C22FAE80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA FREE DV TLS RSA CA G1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA FREE DV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2BA4016CDA14A2821F93D252E02026A7
- SHA-256: DFD9FB07A42E81216D6497FBC47BE53D829BBFD6A9188B02D5C8CDE29E01CF5C
- SPKI SHA-256: 0E013E0852B3FE1FB4184192E7DA50B3208C5C23E82108C5A3A36FD3CFA32FCA
- Validity: 2024-12-04 to 2034-12-04
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gfreedvtlscag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:a4:01:6c:da:14:a2:82:1f:93:d2:52:e0:20:26:a7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Dec  4 16:00:00 2024 GMT
            Not After : Dec  4 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA FREE DV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                F1:80:82:83:9D:6B:B5:C2:0A:6A:43:C2:D5:84:A9:F6:F3:EF:2D:C9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DFD9FB07A42E81216D6497FBC47BE53D829BBFD6A9188B02D5C8CDE29E01CF5C
    SPKI SHA256: 0E013E0852B3FE1FB4184192E7DA50B3208C5C23E82108C5A3A36FD3CFA32FCA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Global G3 Code Signing

- Subject: countryName=CN, stateOrProvinceName=Shanghai, organizationName=UniTrust, commonName=SHECA Global G3 Code Signing
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 5373D1CE3891DB30D83DAD7D40919E09
- SHA-256: EAA5AD8E9A2FA992354B2FF4254BEB08A632F7F17602604DDED58D73D616D844
- SPKI SHA-256: 2C3C80D94BA7AA78F211E067272395C6F2F1351F58BA56CE2BBBABC6022B3944
- Validity: 2016-03-11 to 2030-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ucaglobalg2root/ucaglobalg2root.ocsp
- CRL DP: http://ldap2.sheca.com/root/ucaglobalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:73:d1:ce:38:91:db:30:d8:3d:ad:7d:40:91:9e:09
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 11 00:00:00 2016 GMT
            Not After : Dec 31 00:00:00 2030 GMT
        Subject: C = CN, ST = Shanghai, O = UniTrust, CN = SHECA Global G3 Code Signing
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.sheca.com/policy/
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ucaglobalg2root/ucaglobalg2root.ocsp
                CA Issuers - URI:http://ldap2.sheca.com/root/ucaglobalg2root.der
            X509v3 Subject Key Identifier:
                F7:3D:F9:39:A8:D9:87:54:AC:77:8E:F5:D9:95:EE:F8:35:AB:94:39
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/ucaglobalg2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EAA5AD8E9A2FA992354B2FF4254BEB08A632F7F17602604DDED58D73D616D844
    SPKI SHA256: 2C3C80D94BA7AA78F211E067272395C6F2F1351F58BA56CE2BBBABC6022B3944
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/ucaglobalg2root/ucaglobalg2root.ocsp
- AIA CA Issuers: http://ldap2.sheca.com/root/ucaglobalg2root.der
- CRL Distribution Points: http://ldap2.sheca.com/root/ucaglobalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Global G3 SSL

- Subject: countryName=CN, stateOrProvinceName=Shanghai, organizationName=UniTrust, commonName=SHECA Global G3 SSL
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 547AB8E65918A2B9BFDA14A68DC58EB2
- SHA-256: AEFFE4335EE56422E927F45E95AE142B9EB35979A7400569AE9BDEA6CAABC1DC
- SPKI SHA-256: FB70D8BFECD6CA71FF54A0C3CD2B06F51E467DE5C5B7EF85E01F0FD2D02846C5
- Validity: 2016-03-11 to 2030-12-31
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/sslg3-1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ucaglobalg2root/ucaglobalg2root.ocsp
- CRL DP: http://ldap2.sheca.com/root/ucaglobalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:7a:b8:e6:59:18:a2:b9:bf:da:14:a6:8d:c5:8e:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 11 00:00:00 2016 GMT
            Not After : Dec 31 00:00:00 2030 GMT
        Subject: C = CN, ST = Shanghai, O = UniTrust, CN = SHECA Global G3 SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.sheca.com/policy/
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ucaglobalg2root/ucaglobalg2root.ocsp
                CA Issuers - URI:http://ldap2.sheca.com/root/ucaglobalg2root.der
            X509v3 Subject Key Identifier:
                98:20:F0:F1:D9:42:A6:DE:83:3F:99:10:19:00:3D:68:68:D2:01:81
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/ucaglobalg2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AEFFE4335EE56422E927F45E95AE142B9EB35979A7400569AE9BDEA6CAABC1DC
    SPKI SHA256: FB70D8BFECD6CA71FF54A0C3CD2B06F51E467DE5C5B7EF85E01F0FD2D02846C5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/ucaglobalg2root/ucaglobalg2root.ocsp
- AIA CA Issuers: http://ldap2.sheca.com/root/ucaglobalg2root.der
- CRL Distribution Points: http://ldap2.sheca.com/root/ucaglobalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA IV SMIME ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA IV SMIME ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME ECC Root CA R2
- Serial: 5E60FA86E0CE5AE740A8693A870FB13B
- SHA-256: E82D794C1AC79F9BEBF3B6D98A237F84C15FD40C3ABB86C2214E699414F8FF54
- SPKI SHA-256: 80A086A730B4AAA3EC212575C2763CC1316FD00A84AD567527A4949FED4DF08C
- Validity: 2024-03-27 to 2034-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/givsmimeca2a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.4, 2.23.140.1.5.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar2
- CRL DP: http://crl.global.sheca.com/root/gsmimercar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:60:fa:86:e0:ce:5a:e7:40:a8:69:3a:87:0f:b1:3b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA IV SMIME ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                01:9F:FA:AC:3E:11:6D:FE:4D:7A:39:12:20:5E:F4:09:85:31:3E:4C
            X509v3 Subject Key Identifier:
                98:3B:C3:F8:CE:A5:54:06:5F:B1:CD:3F:99:F4:B7:6A:B2:C2:2E:C5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.9.4
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.5.4.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gsmimercar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gsmimercar2
                CA Issuers - URI:http://certs.global.sheca.com/gsmimercar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E82D794C1AC79F9BEBF3B6D98A237F84C15FD40C3ABB86C2214E699414F8FF54
    SPKI SHA256: 80A086A730B4AAA3EC212575C2763CC1316FD00A84AD567527A4949FED4DF08C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.4, 2.23.140.1.5.4.3
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar2
- AIA CA Issuers: http://certs.global.sheca.com/gsmimercar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gsmimercar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA IV SMIME RSA CA 1A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA IV SMIME RSA CA 1A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME RSA Root CA R1
- Serial: 45A92AA69FF323A384D51F98DEF9AAFE
- SHA-256: 82BA6F1067468383757DF53F1628258043BBB972E1CAD31FD7AAD0ADD66A5B53
- SPKI SHA-256: AD1C31A91DB91D057B386EA03D5E3CBA35C2FF266DEBC553888A1DA166FA2F77
- Validity: 2024-03-27 to 2034-03-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/givsmimeca1a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.4, 2.23.140.1.5.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar1
- CRL DP: http://crl.global.sheca.com/root/gsmimercar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:a9:2a:a6:9f:f3:23:a3:84:d5:1f:98:de:f9:aa:fe
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA IV SMIME RSA CA 1A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:7C:23:3E:DD:63:96:A2:44:49:FE:AC:6C:B8:23:88:B8:C8:68:F3
            X509v3 Subject Key Identifier:
                07:31:D0:82:BC:0A:0A:EF:2F:46:46:17:AF:73:F5:C0:5E:39:76:BE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.9.4
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.5.4.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gsmimercar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gsmimercar1
                CA Issuers - URI:http://certs.global.sheca.com/gsmimercar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 82BA6F1067468383757DF53F1628258043BBB972E1CAD31FD7AAD0ADD66A5B53
    SPKI SHA256: AD1C31A91DB91D057B386EA03D5E3CBA35C2FF266DEBC553888A1DA166FA2F77
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.4, 2.23.140.1.5.4.3
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar1
- AIA CA Issuers: http://certs.global.sheca.com/gsmimercar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gsmimercar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA MV SMIME ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA MV SMIME ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME ECC Root CA R2
- Serial: 5F06E0572EF7B8A1464E295A9B0BBE8D
- SHA-256: D7C4AB9D315AE8B889DA902C55264295D8CDC0F5471370490F4D4585E2C3C6D3
- SPKI SHA-256: BF4B70279DA3BB57EFC3CE74FF75DDC98DE68116EC6D1167B29C769EBA6D1761
- Validity: 2024-03-27 to 2034-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gmvsmimeca2a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.1, 2.23.140.1.5.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar2
- CRL DP: http://crl.global.sheca.com/root/gsmimercar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5f:06:e0:57:2e:f7:b8:a1:46:4e:29:5a:9b:0b:be:8d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA MV SMIME ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                01:9F:FA:AC:3E:11:6D:FE:4D:7A:39:12:20:5E:F4:09:85:31:3E:4C
            X509v3 Subject Key Identifier:
                D9:B9:8D:06:C0:DB:D5:6A:34:97:D7:A9:B0:E9:AE:8B:61:B9:F0:32
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.9.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.5.1.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gsmimercar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gsmimercar2
                CA Issuers - URI:http://certs.global.sheca.com/gsmimercar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D7C4AB9D315AE8B889DA902C55264295D8CDC0F5471370490F4D4585E2C3C6D3
    SPKI SHA256: BF4B70279DA3BB57EFC3CE74FF75DDC98DE68116EC6D1167B29C769EBA6D1761
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.1, 2.23.140.1.5.1.3
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar2
- AIA CA Issuers: http://certs.global.sheca.com/gsmimercar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gsmimercar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA MV SMIME RSA CA 1A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA MV SMIME RSA CA 1A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME RSA Root CA R1
- Serial: 7D698CDB7561381646E0D3A89A9C7FFD
- SHA-256: 92148A115D26B287254B36164164B2220EE36B405D3B708CF5B7AB060C66B1FE
- SPKI SHA-256: E79192A6989F3211B42B8097C8E9ADE1B2133C7A5E662D08A398046E17D36130
- Validity: 2024-03-27 to 2034-03-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gmvsmimeca1a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.1, 2.23.140.1.5.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar1
- CRL DP: http://crl.global.sheca.com/root/gsmimercar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:69:8c:db:75:61:38:16:46:e0:d3:a8:9a:9c:7f:fd
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA MV SMIME RSA CA 1A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:7C:23:3E:DD:63:96:A2:44:49:FE:AC:6C:B8:23:88:B8:C8:68:F3
            X509v3 Subject Key Identifier:
                83:89:75:C4:97:C3:17:A6:53:2B:73:F3:1C:7F:BC:AE:A2:FE:1E:90
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.9.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.5.1.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gsmimercar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gsmimercar1
                CA Issuers - URI:http://certs.global.sheca.com/gsmimercar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 92148A115D26B287254B36164164B2220EE36B405D3B708CF5B7AB060C66B1FE
    SPKI SHA256: E79192A6989F3211B42B8097C8E9ADE1B2133C7A5E662D08A398046E17D36130
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.1, 2.23.140.1.5.1.3
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar1
- AIA CA Issuers: http://certs.global.sheca.com/gsmimercar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gsmimercar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV Server CA G5

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV Server CA G5
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 59D39D9525A71EE9907FC1722B989E72
- SHA-256: 8AB3A0ACF289E6EF754BE449236843D67F45C191BDDD66484B85E6E60556A9AF
- SPKI SHA-256: 325F63B48A3A09A6702EDEEAEAD956F71E2840D96B1C2F8040E1CFD7B497B429
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ovscag5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:d3:9d:95:25:a7:1e:e9:90:7f:c1:72:2b:98:9e:72
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV Server CA G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                03:79:A3:8D:52:5F:D4:E9:88:92:1F:43:58:54:25:02:F4:87:8B:7E
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8AB3A0ACF289E6EF754BE449236843D67F45C191BDDD66484B85E6E60556A9AF
    SPKI SHA256: 325F63B48A3A09A6702EDEEAEAD956F71E2840D96B1C2F8040E1CFD7B497B429
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV Server CA G6

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV Server CA G6
- Issuer: countryName=CN, organizationName=Unitrust, commonName=UCA Extended Validation Root
- Serial: 47468FC559605F55FEB7A9926E4D184F
- SHA-256: 264DF1458FB5EF1FC9DF9F1345E84A6CC1A471CF475AE7598FF52B86713519FB
- SPKI SHA-256: 4D5BB6720FF3D0682853A545C9C1BCC62EF5047567AEA301C55968BE5FD6F0E9
- Validity: 2022-11-08 to 2037-11-08
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- CRL DP: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:46:8f:c5:59:60:5f:55:fe:b7:a9:92:6e:4d:18:4f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = Unitrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Nov  8 16:00:00 2022 GMT
            Not After : Nov  8 15:59:59 2037 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV Server CA G6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evg1
                CA Issuers - URI:http://certs.global.sheca.com/evg1.cer
            X509v3 Subject Key Identifier:
                FB:7D:CE:49:05:B4:20:BC:FF:BF:0D:84:71:AD:AE:01:35:F9:61:A0
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evg1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 264DF1458FB5EF1FC9DF9F1345E84A6CC1A471CF475AE7598FF52B86713519FB
    SPKI SHA256: 4D5BB6720FF3D0682853A545C9C1BCC62EF5047567AEA301C55968BE5FD6F0E9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- AIA CA Issuers: http://certs.global.sheca.com/evg1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV Server CA G7

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV Server CA G7
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 7BD20CF9D6E1F934D999A8D67A079619
- SHA-256: F6F8BCD413C9733166E85843B468DD36E727152D9A37B15129C0E7648ECEE639
- SPKI SHA-256: 02F8BF40EA62E7DB99CDF2E692B761EAF8DE9B4DDCD48F1C841DED2BF3852FB3
- Validity: 2023-03-28 to 2038-03-28
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ovscag7.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- CRL DP: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:d2:0c:f9:d6:e1:f9:34:d9:99:a8:d6:7a:07:96:19
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Mar 28 16:00:00 2023 GMT
            Not After : Mar 28 15:59:59 2038 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV Server CA G7
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/evg1
                CA Issuers - URI:http://certs.global.sheca.com/evg1.cer
            X509v3 Subject Key Identifier:
                A0:F3:44:BA:17:51:2C:77:76:AB:44:42:C5:53:4B:16:AB:5F:0D:AA
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/evg1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6F8BCD413C9733166E85843B468DD36E727152D9A37B15129C0E7648ECEE639
    SPKI SHA256: 02F8BF40EA62E7DB99CDF2E692B761EAF8DE9B4DDCD48F1C841DED2BF3852FB3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/evg1
- AIA CA Issuers: http://certs.global.sheca.com/evg1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV SMIME ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV SMIME ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME ECC Root CA R2
- Serial: 66D2578982613F60FF4B73C7B35D3503
- SHA-256: 229B7FBCA2361DE63171067DE91DFFB3D2FA71A5ABE51CA41D5300C5750D2F0E
- SPKI SHA-256: 5240F8509368584A2871BCD7FC9A8F0B4ED4C2BD42CD8E617F5F729CD36AC57A
- Validity: 2024-03-27 to 2034-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govsmimeca2a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.2, 2.23.140.1.5.2.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar2
- CRL DP: http://crl.global.sheca.com/root/gsmimercar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:d2:57:89:82:61:3f:60:ff:4b:73:c7:b3:5d:35:03
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV SMIME ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                01:9F:FA:AC:3E:11:6D:FE:4D:7A:39:12:20:5E:F4:09:85:31:3E:4C
            X509v3 Subject Key Identifier:
                1C:D1:5D:60:61:27:7F:08:4A:21:AD:95:18:E4:31:91:D6:39:DC:18
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.9.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.5.2.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gsmimercar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gsmimercar2
                CA Issuers - URI:http://certs.global.sheca.com/gsmimercar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 229B7FBCA2361DE63171067DE91DFFB3D2FA71A5ABE51CA41D5300C5750D2F0E
    SPKI SHA256: 5240F8509368584A2871BCD7FC9A8F0B4ED4C2BD42CD8E617F5F729CD36AC57A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.2, 2.23.140.1.5.2.3
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar2
- AIA CA Issuers: http://certs.global.sheca.com/gsmimercar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gsmimercar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV SMIME RSA CA 1A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV SMIME RSA CA 1A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global SMIME RSA Root CA R1
- Serial: 7035A2B93E7BAFB5BAFF7D34AB282EF4
- SHA-256: 6B661B964F2359C4CA68355243A2EEEDA9BACDA191D103A0C1119EC892018AC7
- SPKI SHA-256: A739A6F256D701794ACCDEB485AE8642B64A89B2C5782AA238FE56B10910A356
- Validity: 2024-03-27 to 2034-03-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govsmimeca1a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.2, 2.23.140.1.5.2.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar1
- CRL DP: http://crl.global.sheca.com/root/gsmimercar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:35:a2:b9:3e:7b:af:b5:ba:ff:7d:34:ab:28:2e:f4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global SMIME RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV SMIME RSA CA 1A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:7C:23:3E:DD:63:96:A2:44:49:FE:AC:6C:B8:23:88:B8:C8:68:F3
            X509v3 Subject Key Identifier:
                82:96:4C:63:7D:30:CB:28:41:C5:3A:C7:E8:4D:1E:B9:94:89:FF:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.9.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.5.2.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gsmimercar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gsmimercar1
                CA Issuers - URI:http://certs.global.sheca.com/gsmimercar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6B661B964F2359C4CA68355243A2EEEDA9BACDA191D103A0C1119EC892018AC7
    SPKI SHA256: A739A6F256D701794ACCDEB485AE8642B64A89B2C5782AA238FE56B10910A356
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 1.2.156.112570.1.9.2, 2.23.140.1.5.2.3
- AIA OCSP: http://ocsp.global.sheca.com/gsmimercar1
- AIA CA Issuers: http://certs.global.sheca.com/gsmimercar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gsmimercar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV TLS ECC CA 2026 S1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS ECC CA 2026 S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 222662EC13C7343C00F311A0A8B69479
- SHA-256: CF4D8C93933C09E1457429DDDE814E88BCE8DB9CAE5AF175660A7142C319DDA8
- SPKI SHA-256: AFD237328F96EFC7B0AF6702D299D96C5CBE854EEB8E31FB118999ACDBC744ED
- Validity: 2026-02-08 to 2029-02-04
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govtlsecc2026s1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:26:62:ec:13:c7:34:3c:00:f3:11:a0:a8:b6:94:79
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Feb  8 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV TLS ECC CA 2026 S1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Subject Key Identifier:
                07:CC:EA:10:1A:5E:5C:36:F2:66:64:EE:5B:13:D0:91:B1:FE:79:80
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CF4D8C93933C09E1457429DDDE814E88BCE8DB9CAE5AF175660A7142C319DDA8
    SPKI SHA256: AFD237328F96EFC7B0AF6702D299D96C5CBE854EEB8E31FB118999ACDBC744ED
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV TLS ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Serial: 4127ACCA112C804249EF2B4FD06AF0E3
- SHA-256: 08BA64405A3406C97BDCBD0E44224E6DD341F3EC93F1368457DFA7CAC88BE150
- SPKI SHA-256: F5BD8CEEE8858072C5AD4A6F04785E36ADAE6DB076ADD549584A92C4F88BC653
- Validity: 2024-03-27 to 2029-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govtlsca2a.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:27:ac:ca:11:2c:80:42:49:ef:2b:4f:d0:6a:f0:e3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV TLS ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Subject Key Identifier:
                DD:EB:85:D8:41:28:7C:E9:E5:EC:97:56:06:3A:22:E1:FE:D1:71:C7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 08BA64405A3406C97BDCBD0E44224E6DD341F3EC93F1368457DFA7CAC88BE150
    SPKI SHA256: F5BD8CEEE8858072C5AD4A6F04785E36ADAE6DB076ADD549584A92C4F88BC653
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV TLS ECC CA G6

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS ECC CA G6
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 3E2F27CBEF7E946ED8E761742B9DA6A4
- SHA-256: C4DA2C937523D42054FBB4AF694BB90FC7743C910EE048726241BD84C38509D9
- SPKI SHA-256: 8D00700B4D9DBE1E180D9FA2C8714346FDFD6A8DB02ED90C14208D9D0AC5390F
- Validity: 2024-12-04 to 2034-12-04
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govtlscag6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:2f:27:cb:ef:7e:94:6e:d8:e7:61:74:2b:9d:a6:a4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Dec  4 16:00:00 2024 GMT
            Not After : Dec  4 15:59:59 2034 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV TLS ECC CA G6
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                25:69:CC:EF:DB:56:4A:83:BA:C1:52:84:50:0F:13:D8:61:04:FE:E0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C4DA2C937523D42054FBB4AF694BB90FC7743C910EE048726241BD84C38509D9
    SPKI SHA256: 8D00700B4D9DBE1E180D9FA2C8714346FDFD6A8DB02ED90C14208D9D0AC5390F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV TLS RSA CA 1A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS RSA CA 1A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 2B00373C198A3E45D360C6E2C3F37ED9
- SHA-256: 7F8EF707C2D9A4B7D4ED5FDDC8AF4A64D99BF297D03F8F01C4375DE74B1C7DE1
- SPKI SHA-256: 886C93DBC0D0FD475B1E72FFE44AEFFD48819601F74FB0CB783EEDE321299E9E
- Validity: 2024-03-27 to 2029-03-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govtlsca1a.crl, http://crl.global.sheca.com/govtlsca1a.crl/49d349ff/c73c/ae3a/d83341b2/90bb55c9509ed330.crl, http://crl.global.sheca.com/govtlscaa1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:00:37:3c:19:8a:3e:45:d3:60:c6:e2:c3:f3:7e:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV TLS RSA CA 1A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Subject Key Identifier:
                D8:D5:D8:5A:18:25:36:6A:16:C2:F7:2F:A4:0F:AA:25:A4:5F:12:96
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7F8EF707C2D9A4B7D4ED5FDDC8AF4A64D99BF297D03F8F01C4375DE74B1C7DE1
    SPKI SHA256: 886C93DBC0D0FD475B1E72FFE44AEFFD48819601F74FB0CB783EEDE321299E9E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV TLS RSA CA 2026 S1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS RSA CA 2026 S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Serial: 26EC726B362D528BC58E945CBB6B9B3F
- SHA-256: ABCF1196899441D6407014518963A1A3FA26B22A2DC91710844585819890CC4B
- SPKI SHA-256: 12A5F19A391048070AC2F6FBA9C24A1F7805196580601AC8282E0F997A60FFC2
- Validity: 2026-02-08 to 2029-02-04
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govtlsrsa2026s1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:ec:72:6b:36:2d:52:8b:c5:8e:94:5c:bb:6b:9b:3f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Validity
            Not Before: Feb  8 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV TLS RSA CA 2026 S1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Subject Key Identifier:
                F2:17:EC:ED:9B:7C:74:A4:45:21:3B:16:09:A3:3D:6A:47:C7:A1:CC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtlsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtlsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtlsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: ABCF1196899441D6407014518963A1A3FA26B22A2DC91710844585819890CC4B
    SPKI SHA256: 12A5F19A391048070AC2F6FBA9C24A1F7805196580601AC8282E0F997A60FFC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/gtlsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtlsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA OV TLS RSA CA A1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA OV TLS RSA CA A1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 6B618632C85E4BC144CAA605AC01C7C7
- SHA-256: E7B1C6B04B6C9A3A2960D3888F8081880AC214ABBD01BF9E0362A8354CFCA720
- SPKI SHA-256: 588EA71AC7253D400148A5B72725A4726833EF384EEBE63CEE117F38DF4629B1
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/govtlscav2a1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:61:86:32:c8:5e:4b:c1:44:ca:a6:05:ac:01:c7:c7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA OV TLS RSA CA A1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                A6:21:03:A3:BC:BA:C4:F0:DF:79:21:C0:60:F0:69:EF:6A:A2:4D:54
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E7B1C6B04B6C9A3A2960D3888F8081880AC214ABBD01BF9E0362A8354CFCA720
    SPKI SHA256: 588EA71AC7253D400148A5B72725A4726833EF384EEBE63CEE117F38DF4629B1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA RSA Code Signing CA G3

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Code Signing CA G3
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 47BA2077F31CCD4A3E3D9E4101C8F347
- SHA-256: C7E976AA77E92491C269840B2F1461E65147A2BB181EE59AB63BCD86704FE456
- SPKI SHA-256: D591796A6C0BE1A486F9867CE84E78149CB0B9D8C7775DC417D465322A270889
- Validity: 2018-04-27 to 2033-04-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/csg3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- CRL DP: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:ba:20:77:f3:1c:cd:4a:3e:3d:9e:41:01:c8:f3:47
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2018 GMT
            Not After : Apr 27 15:59:59 2033 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA RSA Code Signing CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ocsp/root/root.ocsp
                CA Issuers - URI:http://certs.sheca.com/r/globalg2.cer
            X509v3 Subject Key Identifier:
                FD:7E:C8:7A:C2:77:1C:56:87:D2:AE:F8:07:C7:42:6A:1B:7C:42:A8
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C7E976AA77E92491C269840B2F1461E65147A2BB181EE59AB63BCD86704FE456
    SPKI SHA256: D591796A6C0BE1A486F9867CE84E78149CB0B9D8C7775DC417D465322A270889
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.1, 2.23.140.1.4.1
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- AIA CA Issuers: http://certs.sheca.com/r/globalg2.cer
- CRL Distribution Points: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cert_ext_invalid_der: The 2.5.29.37 extension is not properly DER-encoded ('critical' must be absent when FALSE)

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA RSA Domain Validation Server CA G3

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Domain Validation Server CA G3
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 45BC3A5A3B9762660792BF95059DEBD1
- SHA-256: 0A552A65F22FF820E7EC3D43BBF88B02ABC34BD247E0C3505891B6342F16A5F2
- SPKI SHA-256: 37A3AB33428A420475CCE4680CA90B2C510A0180A64BFF387696CB97FA8D3A75
- Validity: 2018-04-27 to 2033-04-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/dvsslg3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- CRL DP: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:bc:3a:5a:3b:97:62:66:07:92:bf:95:05:9d:eb:d1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2018 GMT
            Not After : Apr 27 15:59:59 2033 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA RSA Domain Validation Server CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.sheca.com/repository
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ocsp/root/root.ocsp
                CA Issuers - URI:http://certs.sheca.com/r/globalg2.cer
            X509v3 Subject Key Identifier:
                05:7A:4D:75:6F:FD:0A:83:B1:67:16:75:77:3E:14:C5:F5:3C:54:8E
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0A552A65F22FF820E7EC3D43BBF88B02ABC34BD247E0C3505891B6342F16A5F2
    SPKI SHA256: 37A3AB33428A420475CCE4680CA90B2C510A0180A64BFF387696CB97FA8D3A75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- AIA CA Issuers: http://certs.sheca.com/r/globalg2.cer
- CRL Distribution Points: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cert_ext_invalid_der: The 2.5.29.37 extension is not properly DER-encoded ('critical' must be absent when FALSE)

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA RSA Extended Validation Code Signing CA

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Extended Validation Code Signing CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 7F993A8390EC929B8879384B11657095
- SHA-256: D404FAFA4BA2F426B66CD219C6DA84F91C0FB7CB58429EC8077E2A764314D55D
- SPKI SHA-256: 14523394CC395DCE84D8B42E643252214A7A8A563F84C677A55EFDC8E76AC53F
- Validity: 2018-04-27 to 2033-04-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/evcsg1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 1.2.156.112570.1.2.3, 2.23.140.1.4.1, 2.23.140.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- CRL DP: http://ldap2.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:99:3a:83:90:ec:92:9b:88:79:38:4b:11:65:70:95
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Apr 27 16:00:00 2018 GMT
            Not After : Apr 27 15:59:59 2033 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA RSA Extended Validation Code Signing CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.2.2
                Policy: 1.2.156.112570.1.2.3
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.1
                Policy: 2.23.140.1.3
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ocsp/root/root.ocsp
                CA Issuers - URI:http://certs.sheca.com/r/evg1.cer
            X509v3 Subject Key Identifier:
                8E:40:66:5F:6A:A9:40:C2:B9:F1:F0:4A:22:63:95:64:59:37:07:E5
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/evg1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D404FAFA4BA2F426B66CD219C6DA84F91C0FB7CB58429EC8077E2A764314D55D
    SPKI SHA256: 14523394CC395DCE84D8B42E643252214A7A8A563F84C677A55EFDC8E76AC53F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.2.156.112570.1.2.2, 1.2.156.112570.1.2.3, 2.23.140.1.4.1, 2.23.140.1.3
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- AIA CA Issuers: http://certs.sheca.com/r/evg1.cer
- CRL Distribution Points: http://ldap2.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cert_ext_invalid_der: The 2.5.29.37 extension is not properly DER-encoded ('critical' must be absent when FALSE)

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA RSA Extended Validation Server CA

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Extended Validation Server CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Extended Validation Root
- Serial: 52E843B1967E54CEA0592C37A16F9A94
- SHA-256: 4FD6FA527157EEA463689D7A4C2B934EF222279725413893D9847242C85CA9DF
- SPKI SHA-256: 7521495F3E2F1CE5A579A1B53A001B2C5DEB5076D2336011E958AEF71752A25F
- Validity: 2018-04-27 to 2033-04-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/evsslg1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- CRL DP: http://ldap2.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:e8:43:b1:96:7e:54:ce:a0:59:2c:37:a1:6f:9a:94
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Extended Validation Root
        Validity
            Not Before: Apr 27 16:00:00 2018 GMT
            Not After : Apr 27 15:59:59 2033 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA RSA Extended Validation Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.sheca.com/repository
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ocsp/root/root.ocsp
                CA Issuers - URI:http://certs.sheca.com/r/evg1.cer
            X509v3 Subject Key Identifier:
                3B:4B:25:2A:77:37:2A:FC:B9:7F:ED:A8:BD:AF:22:99:FC:5D:C5:F4
            X509v3 Authority Key Identifier:
                D9:74:3A:E4:30:3D:0D:F7:12:DC:7E:5A:05:9F:1E:34:9A:F7:E1:14
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/evg1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4FD6FA527157EEA463689D7A4C2B934EF222279725413893D9847242C85CA9DF
    SPKI SHA256: 7521495F3E2F1CE5A579A1B53A001B2C5DEB5076D2336011E958AEF71752A25F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- AIA CA Issuers: http://certs.sheca.com/r/evg1.cer
- CRL Distribution Points: http://ldap2.sheca.com/root/evg1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cert_ext_invalid_der: The 2.5.29.37 extension is not properly DER-encoded ('critical' must be absent when FALSE)

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA RSA Organization Validation Server CA G3

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Organization Validation Server CA G3
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 7465177ADA1CF0F321BBEC942AAC6BFB
- SHA-256: 26FD4C4367E463D39C71796AE4010E53380DC93BC132FB019D6718A6873E81F4
- SPKI SHA-256: D09035AB572D93FE09F2A4B4B7E1A125A1B97A0543ABD481DF7A0C63B48CA5FB
- Validity: 2018-04-27 to 2033-04-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ovsslg3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- CRL DP: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:65:17:7a:da:1c:f0:f3:21:bb:ec:94:2a:ac:6b:fb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2018 GMT
            Not After : Apr 27 15:59:59 2033 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA RSA Organization Validation Server CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.sheca.com/repository
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ocsp/root/root.ocsp
                CA Issuers - URI:http://certs.sheca.com/r/globalg2.cer
            X509v3 Subject Key Identifier:
                31:60:68:09:1E:32:F9:F6:CC:C0:62:15:AA:7B:91:AF:4C:11:9D:40
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 26FD4C4367E463D39C71796AE4010E53380DC93BC132FB019D6718A6873E81F4
    SPKI SHA256: D09035AB572D93FE09F2A4B4B7E1A125A1B97A0543ABD481DF7A0C63B48CA5FB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- AIA CA Issuers: http://certs.sheca.com/r/globalg2.cer
- CRL Distribution Points: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cert_ext_invalid_der: The 2.5.29.37 extension is not properly DER-encoded ('critical' must be absent when FALSE)

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA RSA Time Stamp Authority G1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA RSA Time Stamp Authority G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 4D11C1710D2287C0EA21CFECE1E074B0
- SHA-256: 86EE4A2F93137CA8887674078B394070F189B3049DD2D24053AE92924254C668
- SPKI SHA-256: 92C1C30390C3C50F465E8F1EDE3865D3C4C8672312D729E345CB0B07A48B447F
- Validity: 2018-04-27 to 2033-04-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/tsag1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- CRL DP: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:11:c1:71:0d:22:87:c0:ea:21:cf:ec:e1:e0:74:b0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2018 GMT
            Not After : Apr 27 15:59:59 2033 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA RSA Time Stamp Authority G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.4
                  CPS: https://www.sheca.com/repository
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp3.sheca.com/ocsp/root/root.ocsp
                CA Issuers - URI:http://certs.sheca.com/r/globalg2.cer
            X509v3 Subject Key Identifier:
                6F:C5:77:0C:4E:82:5E:4B:54:4B:30:BD:99:33:F4:08:57:1A:3D:B4
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://ldap2.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 86EE4A2F93137CA8887674078B394070F189B3049DD2D24053AE92924254C668
    SPKI SHA256: 92C1C30390C3C50F465E8F1EDE3865D3C4C8672312D729E345CB0B07A48B447F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4
- AIA OCSP: http://ocsp3.sheca.com/ocsp/root/root.ocsp
- AIA CA Issuers: http://certs.sheca.com/r/globalg2.cer
- CRL Distribution Points: http://ldap2.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cert_ext_invalid_der: The 2.5.29.37 extension is not properly DER-encoded ('critical' must be absent when FALSE)

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA SMIME CA G1

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA SMIME CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 521BB62707A1516DE4CA2A2D91EDCCA1
- SHA-256: 8100D384D6C4529883C37C37C68FD4903C41CCBCB9033A9C733A6AF0806E1DE7
- SPKI SHA-256: 809183B19F0D3C234201266CCD894A03C9A6588623DB57A173C22370846E6991
- Validity: 2021-08-18 to 2036-08-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/smimecag1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.3.1, 1.2.156.112570.1.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:1b:b6:27:07:a1:51:6d:e4:ca:2a:2d:91:ed:cc:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Aug 18 16:00:00 2021 GMT
            Not After : Aug 18 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA SMIME CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.3.1
                  CPS: https://www.sheca.com/repository
                Policy: 1.2.156.112570.1.3.2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Subject Key Identifier:
                1F:A8:0B:4D:CF:9C:A6:A5:3A:DA:B0:96:AB:99:57:B9:0A:9B:7F:5D
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8100D384D6C4529883C37C37C68FD4903C41CCBCB9033A9C733A6AF0806E1DE7
    SPKI SHA256: 809183B19F0D3C234201266CCD894A03C9A6588623DB57A173C22370846E6991
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.3.1, 1.2.156.112570.1.3.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Time Stamping CA G2

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Time Stamping CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 4CBE715B995CBCBCA2B22DEA4C709B57
- SHA-256: 422C71F8DB9FDA2C65458B52363DB6FDC4E37B436774BCF97518F3F42EC725F1
- SPKI SHA-256: B16051C184BC07FE41B0E7CF765EE6FB053BCDAF23AC88908917EBB52E1A8534
- Validity: 2021-03-16 to 2036-03-16
- Key: RSA 3072
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/tscag2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:be:71:5b:99:5c:bc:bc:a2:b2:2d:ea:4c:70:9b:57
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2036 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Time Stamping CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                CF:DD:9E:67:0A:6C:B1:7E:2C:1A:4F:59:53:87:B2:36:9B:F9:69:94
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.4.1
                  CPS: https://www.sheca.com/repository
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 422C71F8DB9FDA2C65458B52363DB6FDC4E37B436774BCF97518F3F42EC725F1
    SPKI SHA256: B16051C184BC07FE41B0E7CF765EE6FB053BCDAF23AC88908917EBB52E1A8534
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Time Stamping ECC CA 2A

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Time Stamping ECC CA 2A
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping ECC Root CA R2
- Serial: 77E2A9A066F0EDC5E3DB5A87E7C5F895
- SHA-256: 0E3FC096DDCC3205047F9042D57882A1144107243C47CDE6FFFDE403A5B7CA04
- SPKI SHA-256: A022ADE7406A25D28D8F38DCC87CF039C110E2251727E09F903DCE22E0C14347
- Validity: 2024-03-27 to 2039-03-27
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gtsca2a.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4.1, 2.23.140.1.4.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtsrcar2
- CRL DP: http://crl.global.sheca.com/root/gtsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            77:e2:a9:a0:66:f0:ed:c5:e3:db:5a:87:e7:c5:f8:95
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Time Stamping ECC Root CA R2
        Validity
            Not Before: Mar 27 16:00:00 2024 GMT
            Not After : Mar 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Time Stamping ECC CA 2A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                3E:7B:91:A2:2A:A9:BD:F1:83:F2:D1:AB:57:9C:B9:63:3E:08:AC:85
            X509v3 Subject Key Identifier:
                35:CD:BC:63:19:E6:8E:CD:A7:AF:DC:EE:01:62:8D:63:03:DE:86:04
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.4.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtsrcar2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtsrcar2
                CA Issuers - URI:http://certs.global.sheca.com/gtsrcar2.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0E3FC096DDCC3205047F9042D57882A1144107243C47CDE6FFFDE403A5B7CA04
    SPKI SHA256: A022ADE7406A25D28D8F38DCC87CF039C110E2251727E09F903DCE22E0C14347
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4.1, 2.23.140.1.4.2
- AIA OCSP: http://ocsp.global.sheca.com/gtsrcar2
- AIA CA Issuers: http://certs.global.sheca.com/gtsrcar2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtsrcar2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SHECA Time Stamping RSA CA 1B

- Subject: countryName=CN, organizationName=UniTrust, commonName=SHECA Time Stamping RSA CA 1B
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global Time Stamping RSA Root CA R1
- Serial: 2FF883FBAB1D0BAEBF3F544BBBB84590
- SHA-256: 9A46D52B0F6A913E6BF3EE6DCFE08B2664DEE2AF704FD4931E8D0C38F3D76D00
- SPKI SHA-256: 854F89F4B75E5524E82C1D194A5C9CC03FBCB707079420CE77913BC7F4A8EC54
- Validity: 2024-05-27 to 2039-05-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/gtsca1b.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4.1, 2.23.140.1.4.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/gtsrcar1
- CRL DP: http://crl.global.sheca.com/root/gtsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:f8:83:fb:ab:1d:0b:ae:bf:3f:54:4b:bb:b8:45:90
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UniTrust Global Time Stamping RSA Root CA R1
        Validity
            Not Before: May 27 16:00:00 2024 GMT
            Not After : May 27 15:59:59 2039 GMT
        Subject: C = CN, O = UniTrust, CN = SHECA Time Stamping RSA CA 1B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                CD:BF:8A:72:26:F2:CA:5C:32:97:65:78:C5:3E:3E:79:24:6B:EA:6D
            X509v3 Subject Key Identifier:
                CC:14:02:16:76:9C:C1:FC:EC:FC:A0:2C:90:C6:3A:B0:B6:A3:61:81
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.4.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.4.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/gtsrcar1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/gtsrcar1
                CA Issuers - URI:http://certs.global.sheca.com/gtsrcar1.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 9A46D52B0F6A913E6BF3EE6DCFE08B2664DEE2AF704FD4931E8D0C38F3D76D00
    SPKI SHA256: 854F89F4B75E5524E82C1D194A5C9CC03FBCB707079420CE77913BC7F4A8EC54
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 1.2.156.112570.1.4.1, 2.23.140.1.4.2
- AIA OCSP: http://ocsp.global.sheca.com/gtsrcar1
- AIA CA Issuers: http://certs.global.sheca.com/gtsrcar1.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/gtsrcar1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SNCA OV TLS RSA CA G1

- Subject: countryName=CN, organizationName=Shaanxi Digital Certificate Authority, commonName=SNCA OV TLS RSA CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 4747AAD98021ED2EC1298E205F69935B
- SHA-256: F077E1AF11CFE1E8A12871F9080B69EFB8B41E8B4A4B95AB513CDF650C76B2C2
- SPKI SHA-256: 1FCC45E49A763CBAEB8230F316D01F9AD3D86B59E6381A44AACE69AFF2126836
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/sncaovtlsrsacag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:47:aa:d9:80:21:ed:2e:c1:29:8e:20:5f:69:93:5b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = Shaanxi Digital Certificate Authority, CN = SNCA OV TLS RSA CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                64:BA:97:BC:60:2A:B6:79:D1:CD:1A:75:AB:9B:2F:0F:96:99:01:C8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F077E1AF11CFE1E8A12871F9080B69EFB8B41E8B4A4B95AB513CDF650C76B2C2
    SPKI SHA256: 1FCC45E49A763CBAEB8230F316D01F9AD3D86B59E6381A44AACE69AFF2126836
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus ECC DV TLS CA G2

- Subject: countryName=CN, organizationName=sslTrus, commonName=sslTrus ECC DV TLS CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2EC363A81F052773EF0B83BC62F6592A
- SHA-256: 32CAA961415106CF471CEA5B15C66464A907C99861A297C359D174624BADB92F
- SPKI SHA-256: 9846DA9E486C266A4FF461EAC7B25CFB9EC4D9B301DCE63EA7E644B0408F14AA
- Validity: 2025-01-05 to 2035-01-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ssltrusdvtlsecccag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:c3:63:a8:1f:05:27:73:ef:0b:83:bc:62:f6:59:2a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = sslTrus, CN = sslTrus ECC DV TLS CA G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                62:46:79:EB:A4:7F:FA:4C:D9:8D:6F:FF:DE:6D:6F:7F:E4:9E:86:E9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 32CAA961415106CF471CEA5B15C66464A907C99861A297C359D174624BADB92F
    SPKI SHA256: 9846DA9E486C266A4FF461EAC7B25CFB9EC4D9B301DCE63EA7E644B0408F14AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus ECC OV TLS CA G2

- Subject: countryName=CN, organizationName=sslTrus, commonName=sslTrus ECC OV TLS CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 30E8B4F8DBD4E9D5449F65584549D7B5
- SHA-256: 06B7E611243D2901B964FF6D0C53A2DB52BA2E1D41E17D74950E16605D9A2C90
- SPKI SHA-256: B6B58FE313AC89407D2E2A2A206C5ACCFA1144C96C27A16EA741578892154880
- Validity: 2025-01-05 to 2035-01-05
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ssltrusovtlsecccag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            30:e8:b4:f8:db:d4:e9:d5:44:9f:65:58:45:49:d7:b5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = sslTrus, CN = sslTrus ECC OV TLS CA G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                BE:E1:14:C1:BE:F8:4D:A5:E3:D4:E4:1F:CA:0D:1F:81:A9:0C:0F:E0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 06B7E611243D2901B964FF6D0C53A2DB52BA2E1D41E17D74950E16605D9A2C90
    SPKI SHA256: B6B58FE313AC89407D2E2A2A206C5ACCFA1144C96C27A16EA741578892154880
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus RSA DV TLS CA G2

- Subject: countryName=CN, organizationName=sslTrus, commonName=sslTrus RSA DV TLS CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 6D3E6B0E532F2910CAFBC822C0161E90
- SHA-256: B3A5BED750BCE5A08C75E0012B0A6A67954952BC8D12520514CC15CBB0B17039
- SPKI SHA-256: 68D9580D4614388F42F85DE20A195AEA8428A69427C95784DDF711DD1B048A46
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ssltrusdvtlsrsacag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6d:3e:6b:0e:53:2f:29:10:ca:fb:c8:22:c0:16:1e:90
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = sslTrus, CN = sslTrus RSA DV TLS CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                DE:E3:86:BA:C5:2E:63:01:64:E0:C1:42:94:3C:32:02:96:7C:68:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B3A5BED750BCE5A08C75E0012B0A6A67954952BC8D12520514CC15CBB0B17039
    SPKI SHA256: 68D9580D4614388F42F85DE20A195AEA8428A69427C95784DDF711DD1B048A46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### sslTrus RSA OV TLS CA G2

- Subject: countryName=CN, organizationName=sslTrus, commonName=sslTrus RSA OV TLS CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 37C33F2AEBC767FB2093686D1E2FCF34
- SHA-256: F0E647B5A2869A3487507A90549AF039896DB8B0F0E7CF92EF3AB567F3EC5E5C
- SPKI SHA-256: 35B3EB830627814E271B333D5DAD5F79504A3635922263553EA8004C5657409F
- Validity: 2025-01-05 to 2035-01-05
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/ssltrusovtlsrsacag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            37:c3:3f:2a:eb:c7:67:fb:20:93:68:6d:1e:2f:cf:34
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jan  5 16:00:00 2025 GMT
            Not After : Jan  5 15:59:59 2035 GMT
        Subject: C = CN, O = sslTrus, CN = sslTrus RSA OV TLS CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                0E:DF:B6:89:48:06:4E:10:81:8E:3C:81:08:C8:24:BB:8B:30:8F:62
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F0E647B5A2869A3487507A90549AF039896DB8B0F0E7CF92EF3AB567F3EC5E5C
    SPKI SHA256: 35B3EB830627814E271B333D5DAD5F79504A3635922263553EA8004C5657409F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia RSA DV TLS CA - S1

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia RSA DV TLS CA - S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 434267BEC68C2AD2846B83AB719FDEB0
- SHA-256: 074ADD7F1E73EB110EC8E2B78A92C51CF5A451135B6F7DEFC019EE9D74BFA4D6
- SPKI SHA-256: 5278681DA9E3E8C624DBDA6ABD3124667016D6F406AC510DC9559FC14FB9704F
- Validity: 2021-03-16 to 2026-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/trustasiarsadvtlscas1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:42:67:be:c6:8c:2a:d2:84:6b:83:ab:71:9f:de:b0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2026 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia RSA DV TLS CA - S1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                94:32:E0:D4:8A:CD:1D:93:E7:5C:53:72:96:0C:5E:F1:F3:F6:79:72
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 074ADD7F1E73EB110EC8E2B78A92C51CF5A451135B6F7DEFC019EE9D74BFA4D6
    SPKI SHA256: 5278681DA9E3E8C624DBDA6ABD3124667016D6F406AC510DC9559FC14FB9704F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### TrustAsia RSA OV TLS CA - S1

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia RSA OV TLS CA - S1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 471AEF9C772AC00A21E7B29173B9EAB6
- SHA-256: D16BA9ACB74FEE4AA8087EE482E86E7F6F5F55FAC5025639730753FE1E705E3C
- SPKI SHA-256: DEC76CA1222E46FB6317C3AC39CE3121D7AF39639C9442D0B9A110F3932A0986
- Validity: 2021-03-16 to 2026-03-16
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/trustasiarsaovtlscas1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:1a:ef:9c:77:2a:c0:0a:21:e7:b2:91:73:b9:ea:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Mar 16 16:00:00 2021 GMT
            Not After : Mar 16 15:59:59 2026 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia RSA OV TLS CA - S1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                F5:75:D4:8E:29:3E:17:A8:A9:C4:9E:DC:E6:DB:0A:34:4D:13:2A:EB
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D16BA9ACB74FEE4AA8087EE482E86E7F6F5F55FAC5025639730753FE1E705E3C
    SPKI SHA256: DEC76CA1222E46FB6317C3AC39CE3121D7AF39639C9442D0B9A110F3932A0986
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### UniTrust Global TLS ECC Root CA R2

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 62CEFC700FE3CA60B3D51FF162DCA400
- SHA-256: 8ED6FA47B14DC79C85ED5C4CE2C67B2F2F96D2B9054690F28BF2DFE9A5770DF0
- SPKI SHA-256: 148250792BA5564CDC393ABEF853DE8693C3ED9A73C09214A3EF43B89290EE31
- Validity: 2025-04-27 to 2035-04-27
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:ce:fc:70:0f:e3:ca:60:b3:d5:1f:f1:62:dc:a4:00
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8ED6FA47B14DC79C85ED5C4CE2C67B2F2F96D2B9054690F28BF2DFE9A5770DF0
    SPKI SHA256: 148250792BA5564CDC393ABEF853DE8693C3ED9A73C09214A3EF43B89290EE31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UniTrust Global TLS ECC Root CA R2

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS ECC Root CA R2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 653051175F5EB30DFF48554BBAA57B17
- SHA-256: F2384371C93EB284166FD07A34F211FAA697B6FC20D4D31F7A8E4A3283CA3FF1
- SPKI SHA-256: 148250792BA5564CDC393ABEF853DE8693C3ED9A73C09214A3EF43B89290EE31
- Validity: 2026-02-05 to 2029-02-04
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtlsrcar2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:30:51:17:5f:5e:b3:0d:ff:48:55:4b:ba:a5:7b:17
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Feb  5 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global TLS ECC Root CA R2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                46:E3:D4:F8:DF:88:83:8A:B7:AE:69:96:6E:00:52:6F:BB:43:D7:91
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F2384371C93EB284166FD07A34F211FAA697B6FC20D4D31F7A8E4A3283CA3FF1
    SPKI SHA256: 148250792BA5564CDC393ABEF853DE8693C3ED9A73C09214A3EF43B89290EE31
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier
- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UniTrust Global TLS RSA Root CA R1

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 63805182BF2320DEF7EC9AAEFB964C61
- SHA-256: E4C25DE1B285B3C45358EF12583A1AA78DB148D0D294F8798339451FC1910542
- SPKI SHA-256: 23EB05A561E1F54C472CE468568CC5D5AFD4E1FA214C6997F60AC373CE59557A
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:80:51:82:bf:23:20:de:f7:ec:9a:ae:fb:96:4c:61
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E4C25DE1B285B3C45358EF12583A1AA78DB148D0D294F8798339451FC1910542
    SPKI SHA256: 23EB05A561E1F54C472CE468568CC5D5AFD4E1FA214C6997F60AC373CE59557A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### UniTrust Global TLS RSA Root CA R1

- Subject: countryName=CN, organizationName=UniTrust, commonName=UniTrust Global TLS RSA Root CA R1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 6029C74DEC5DA804FD34D54B87CCF640
- SHA-256: 50404B08111323C691E1695737556E4AFCDCC87EADD22C5503B6D03392AADDDF
- SPKI SHA-256: 23EB05A561E1F54C472CE468568CC5D5AFD4E1FA214C6997F60AC373CE59557A
- Validity: 2026-02-05 to 2029-02-04
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/root/gtlsrcar1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV, 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:29:c7:4d:ec:5d:a8:04:fd:34:d5:4b:87:cc:f6:40
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Feb  5 16:00:00 2026 GMT
            Not After : Feb  4 15:59:59 2029 GMT
        Subject: C = CN, O = UniTrust, CN = UniTrust Global TLS RSA Root CA R1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                E3:49:C5:A5:00:35:82:FB:63:0C:BB:36:9A:86:E2:4C:41:85:DB:08
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 50404B08111323C691E1695737556E4AFCDCC87EADD22C5503B6D03392AADDDF
    SPKI SHA256: 23EB05A561E1F54C472CE468568CC5D5AFD4E1FA214C6997F60AC373CE59557A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_ca_multiple_reserved_policy_oids: A Subordinate CA certificate MUST include exactly one Reserved Certificate Policy Identifier

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Xinnet DV SSL

- Subject: countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet DV SSL
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 7850E4CCAD8A111CCF098F2268ED0BA9
- SHA-256: 9C53902F9501F6D89766999DBE2AD1A1436420B652535CDC2DC51CCFE2FFEE68
- SPKI SHA-256: 5806386ADCE25142209AD9FC233DD0C2928D71FC61704DBAF988D7D78B35DC80
- Validity: 2023-07-05 to 2028-07-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/xinnetdvssl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:50:e4:cc:ad:8a:11:1c:cf:09:8f:22:68:ed:0b:a9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jul  5 16:00:00 2023 GMT
            Not After : Jul  5 15:59:59 2028 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E6\96\B0\E7\BD\91\E6\95\B0\E7\A0\81\E4\BF\A1\E6\81\AF\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = Xinnet DV SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Subject Key Identifier:
                9D:3A:A5:B8:E2:21:27:83:64:3F:F5:78:DC:22:B0:4E:6B:CB:36:D4
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9C53902F9501F6D89766999DBE2AD1A1436420B652535CDC2DC51CCFE2FFEE68
    SPKI SHA256: 5806386ADCE25142209AD9FC233DD0C2928D71FC61704DBAF988D7D78B35DC80
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Xinnet DV TLS RSA CA G2

- Subject: countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet DV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 3650D725289B1F50AD978BA1CE313D25
- SHA-256: CC379B3FC6555754C11696364926F828A1FAFED714C9AD9203227174E7603BBA
- SPKI SHA-256: 7BA3777967B11077439D6BB4BCDD95824D1D33E5AE1E556AEBBEA98E025977D9
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/xinnetdvtlsg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:50:d7:25:28:9b:1f:50:ad:97:8b:a1:ce:31:3d:25
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E6\96\B0\E7\BD\91\E6\95\B0\E7\A0\81\E4\BF\A1\E6\81\AF\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = Xinnet DV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                AC:D2:DA:F4:03:53:77:A4:9A:47:91:50:95:86:B4:AF:73:E0:A6:29
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CC379B3FC6555754C11696364926F828A1FAFED714C9AD9203227174E7603BBA
    SPKI SHA256: 7BA3777967B11077439D6BB4BCDD95824D1D33E5AE1E556AEBBEA98E025977D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Xinnet OV SSL

- Subject: countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet OV SSL
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 61D34D1AA854A26281586259FAE6B361
- SHA-256: 3C07D7EFC8D458F668C10D4F06F90503CCD25D59E2B3F1D58B32884D9E4E3809
- SPKI SHA-256: D8A74E1979E57142E472A5D42EFEEF5793DE784ACF11EE857896372FC0EBC76C
- Validity: 2023-07-05 to 2028-07-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/xinnetovssl.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:d3:4d:1a:a8:54:a2:62:81:58:62:59:fa:e6:b3:61
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Jul  5 16:00:00 2023 GMT
            Not After : Jul  5 15:59:59 2028 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E6\96\B0\E7\BD\91\E6\95\B0\E7\A0\81\E4\BF\A1\E6\81\AF\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = Xinnet OV SSL
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
            X509v3 Subject Key Identifier:
                4B:78:C0:32:4A:24:42:78:4E:9F:83:F0:D0:FE:33:6C:7E:0D:93:4F
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3C07D7EFC8D458F668C10D4F06F90503CCD25D59E2B3F1D58B32884D9E4E3809
    SPKI SHA256: D8A74E1979E57142E472A5D42EFEEF5793DE784ACF11EE857896372FC0EBC76C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Xinnet OV TLS RSA CA G2

- Subject: countryName=CN, organizationName=北京新网数码信息技术有限公司, commonName=Xinnet OV TLS RSA CA G2
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2E639412B23AC85782563628B9469B35
- SHA-256: D0AEB66EF3649A73FA1F8A0317DB54C61257A7F4A14D1112BE742B5EB63F6622
- SPKI SHA-256: CF755698B0CE27AEA2B267D37A89B8906D6C46CB9EBF12DD502922067AB5F425
- Validity: 2025-04-27 to 2035-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/xinnetovtlsg2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- CRL DP: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:63:94:12:b2:3a:c8:57:82:56:36:28:b9:46:9b:35
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2025 GMT
            Not After : Apr 27 15:59:59 2035 GMT
        Subject: C = CN, O = \E5\8C\97\E4\BA\AC\E6\96\B0\E7\BD\91\E6\95\B0\E7\A0\81\E4\BF\A1\E6\81\AF\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = Xinnet OV TLS RSA CA G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                F9:CC:7E:A1:6B:50:94:86:2E:36:D5:DC:AB:F2:3C:A0:41:2D:33:9A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/grcag2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/grcag2
                CA Issuers - URI:http://certs.global.sheca.com/grcag2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D0AEB66EF3649A73FA1F8A0317DB54C61257A7F4A14D1112BE742B5EB63F6622
    SPKI SHA256: CF755698B0CE27AEA2B267D37A89B8906D6C46CB9EBF12DD502922067AB5F425
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/grcag2
- AIA CA Issuers: http://certs.global.sheca.com/grcag2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/grcag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus RSA DV SSL CA

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA DV SSL CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 3F25A6947968873EC64FF6962E24F011
- SHA-256: 69C25861236502F0C223443FD851A2FB6ACB745BB814AD72BB2E50867C52C3BB
- SPKI SHA-256: 0B0C3593D3331EE2FA0D915FF0ABC8978E0DA9E51DD6CB78793246CD35F59186
- Validity: 2024-04-14 to 2034-04-14
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/zotrusrsadvsslca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:25:a6:94:79:68:87:3e:c6:4f:f6:96:2e:24:f0:11
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 14 16:00:00 2024 GMT
            Not After : Apr 14 15:59:59 2034 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus RSA DV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                7F:EF:9B:0B:9E:B3:F7:17:A5:76:BB:C7:58:02:09:DE:73:15:44:B7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 69C25861236502F0C223443FD851A2FB6ACB745BB814AD72BB2E50867C52C3BB
    SPKI SHA256: 0B0C3593D3331EE2FA0D915FF0ABC8978E0DA9E51DD6CB78793246CD35F59186
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus RSA DV SSL CA G1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA DV SSL CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 7BCBFCDB7AA39C0AF24FF55683F6EBAA
- SHA-256: E7EF1AD946214B32AF03CC287930D0464ED2C086D7A1447C6E27FC9217D4E16B
- SPKI SHA-256: AE55D9E027F77D6B82CCEAD1C14A382A4DFE48B989A1217E7667542DF644DD96
- Validity: 2024-04-27 to 2034-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/zotrusrsadvsslcag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:cb:fc:db:7a:a3:9c:0a:f2:4f:f5:56:83:f6:eb:aa
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2024 GMT
            Not After : Apr 27 15:59:59 2034 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus RSA DV SSL CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                EC:1E:BC:B7:1E:09:27:69:EF:A7:15:E8:9A:A1:67:7C:33:AA:0F:5A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.1
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E7EF1AD946214B32AF03CC287930D0464ED2C086D7A1447C6E27FC9217D4E16B
    SPKI SHA256: AE55D9E027F77D6B82CCEAD1C14A382A4DFE48B989A1217E7667542DF644DD96
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.1, 2.23.140.1.2.1
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus RSA OV SSL CA

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA OV SSL CA
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 2E2CC80673D72C1F790D478A28861237
- SHA-256: 219C59CCD06D0210ADCF6E8125700D1578F69A0670A07FD9DDE99E4AC82524CD
- SPKI SHA-256: 0A9385C29F6EEAC62906265D9D725CB97FB1E30DA2674CBDF11B02149E0955E7
- Validity: 2024-04-14 to 2034-04-14
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/zotrusrsaovsslca.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:2c:c8:06:73:d7:2c:1f:79:0d:47:8a:28:86:12:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 14 16:00:00 2024 GMT
            Not After : Apr 14 15:59:59 2034 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus RSA OV SSL CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                E9:2D:57:AB:2A:44:55:79:9E:25:79:37:12:35:88:FC:DF:18:7A:C3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 219C59CCD06D0210ADCF6E8125700D1578F69A0670A07FD9DDE99E4AC82524CD
    SPKI SHA256: 0A9385C29F6EEAC62906265D9D725CB97FB1E30DA2674CBDF11B02149E0955E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### ZoTrus RSA OV SSL CA G1

- Subject: countryName=CN, organizationName=ZoTrus Technology Limited, commonName=ZoTrus RSA OV SSL CA G1
- Issuer: countryName=CN, organizationName=UniTrust, commonName=UCA Global G2 Root
- Serial: 478AF730C50166CBE0416C6E6C0F0371
- SHA-256: 3EC123D71DB27AE1DC8F877286C222F4C4167A2AE4FD7BCF370789EF4A9521B8
- SPKI SHA-256: 2A0E8D1641473F89EECAB57A5AC172FCDDEB2335F13B26AB5978412DDF106777
- Validity: 2024-04-27 to 2034-04-27
- Key: RSA 3072
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.global.sheca.com/zotrusrsaovsslcag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- CRL DP: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:8a:f7:30:c5:01:66:cb:e0:41:6c:6e:6c:0f:03:71
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = UniTrust, CN = UCA Global G2 Root
        Validity
            Not Before: Apr 27 16:00:00 2024 GMT
            Not After : Apr 27 15:59:59 2034 GMT
        Subject: C = CN, O = ZoTrus Technology Limited, CN = ZoTrus RSA OV SSL CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                81:C4:8C:CC:F5:E4:30:FF:A5:0C:08:5F:8C:15:67:21:74:01:DF:DF
            X509v3 Subject Key Identifier:
                A0:FA:64:A3:7E:B8:3C:7C:19:4C:51:B7:FE:6A:2B:E8:A3:9F:78:A4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.2.156.112570.1.1.2
                  CPS: https://www.sheca.com/repository
                Policy: 2.23.140.1.2.2
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.global.sheca.com/root/globalg2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.global.sheca.com/globalg2
                CA Issuers - URI:http://certs.global.sheca.com/globalg2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3EC123D71DB27AE1DC8F877286C222F4C4167A2AE4FD7BCF370789EF4A9521B8
    SPKI SHA256: 2A0E8D1641473F89EECAB57A5AC172FCDDEB2335F13B26AB5978412DDF106777
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.2.156.112570.1.1.2, 2.23.140.1.2.2
- AIA OCSP: http://ocsp.global.sheca.com/globalg2
- AIA CA Issuers: http://certs.global.sheca.com/globalg2.cer
- CRL Distribution Points: http://crl.global.sheca.com/root/globalg2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers
