# CA Owner Audit Dump - SwissSign AG

Generated: 2026-07-28T08:33:45.583052Z

## CA Owner Summary

- Name: SwissSign AG
- Country: Switzerland
- Website: -
- Problem Reporting: certificatemisuse[at]swisssign[dot]com, keycompromise[at]swisssign[dot]com
- CP/CPS URLs: https://repository.swisssign.com/SwissSign_CP_LCP.pdf, https://repository.swisssign.com/SwissSign_CP_NCP_extended.pdf, https://repository.swisssign.com/SwissSign_CP_NCP.pdf, https://repository.swisssign.com/SwissSign_CP_SMIME_OV.pdf, https://repository.swisssign.com/SwissSign_CPS_SMIME.pdf, https://repository.swisssign.com/SwissSign_CPS_TLS.pdf, https://repository.swisssign.com/SwissSign_CPCPS_TLS.pdf?_gl=1*b7k2k4*_gcl_au*NDc0OTQ3OTYwLjE3Nzg1NzMzODY., https://repository.swisssign.com/SwissSign_CPCPS_TLS.md?_gl=1*ej18e*_gcl_au*NDc0OTQ3OTYwLjE3Nzg1NzMzODY., http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf, http://www.affirmtrust.com/resources/cps, http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
- Audit URLs: https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091201_SwissSign_Standard_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091202_SwissSign_TLS-BR_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091203_SwissSign_TLS-EV_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091204_V2_SwissSign_SMIME-BR_Audit_25.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2017113002_Browser_Audit_Atesttation_s.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2022/12/AA2022113007_Audit_Attestation_SwissSign_Platinum_CA-G2.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=8861552, https://it-tuv.com/wp-content/uploads/2024/09/AA2024090401_SwissSign_Standard_Audit_V1.0.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2024/09/AA2024090402_SwissSign_TLS-BR_Audit_V2.0.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2024/09/AA2024090404_SwissSign_SMIME-BR_Audit_V2.0.pdf, https://cert.webtrust.org/SealFile?seal=1894&file=pdf, https://cert.webtrust.org/SealFile?seal=1896&file=pdf, https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Root Programs: {"mozilla":"Included","chrome":"Removed","microsoft":"Included","apple":"Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: certificatemisuse[at]swisssign[dot]com, keycompromise[at]swisssign[dot]com
- CP/CPS URLs: https://repository.swisssign.com/SwissSign_CP_LCP.pdf, https://repository.swisssign.com/SwissSign_CP_NCP_extended.pdf, https://repository.swisssign.com/SwissSign_CP_NCP.pdf, https://repository.swisssign.com/SwissSign_CP_SMIME_OV.pdf, https://repository.swisssign.com/SwissSign_CPS_SMIME.pdf, https://repository.swisssign.com/SwissSign_CPS_TLS.pdf, https://repository.swisssign.com/SwissSign_CPCPS_TLS.pdf?_gl=1*b7k2k4*_gcl_au*NDc0OTQ3OTYwLjE3Nzg1NzMzODY., https://repository.swisssign.com/SwissSign_CPCPS_TLS.md?_gl=1*ej18e*_gcl_au*NDc0OTQ3OTYwLjE3Nzg1NzMzODY., http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf, http://www.affirmtrust.com/resources/cps, http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
- Audit URLs: https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091201_SwissSign_Standard_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091202_SwissSign_TLS-BR_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091203_SwissSign_TLS-EV_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091204_V2_SwissSign_SMIME-BR_Audit_25.pdf, https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2017113002_Browser_Audit_Atesttation_s.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2022/12/AA2022113007_Audit_Attestation_SwissSign_Platinum_CA-G2.pdf, https://bugzilla.mozilla.org/attachment.cgi?id=8861552, https://it-tuv.com/wp-content/uploads/2024/09/AA2024090401_SwissSign_Standard_Audit_V1.0.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2024/09/AA2024090402_SwissSign_TLS-BR_Audit_V2.0.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2024/09/AA2024090404_SwissSign_SMIME-BR_Audit_V2.0.pdf, https://cert.webtrust.org/SealFile?seal=1894&file=pdf, https://cert.webtrust.org/SealFile?seal=1896&file=pdf, https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Repository URLs: https://www.swisssign.com/en/support/repository.html, http://www.affirmtrust.com/resources/cps, http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf, https://www.swisssign.com/support/repository.html
- Root programs: {"mozilla":"Included","chrome":"Removed","microsoft":"Included","apple":"Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2 | yes | unknown | 2006-10-25 to 2036-10-25 | 2.16.756.1.89.1.2.1.1 | - | - | clean |
| 2 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold Root CA - G3 | yes | unknown | 2009-08-04 to 2037-08-04 | - | - | - | clean |
| 3 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2 | yes | unknown | 2006-10-25 to 2036-10-25 | 2.16.756.1.89.1.1.1.1 | - | - | clean |
| 4 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum Root CA - G3 | yes | unknown | 2009-08-04 to 2037-08-04 | - | - | - | clean |
| 5 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2 | yes | unknown | 2006-10-25 to 2036-10-25 | 2.16.756.1.89.1.3.1.1 | - | - | clean |
| 6 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver Root CA - G3 | yes | unknown | 2009-08-04 to 2037-08-04 | - | - | - | clean |
| 7 | countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Commercial | yes | revoked, expired | 2009-12-01 to 2019-11-02 | 2.5.29.32.0 | - | - | clean |
| 8 | countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking | yes | expired | 2011-09-29 to 2017-11-01 | 2.5.29.32.0 | - | - | clean |
| 9 | countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking | yes | revoked, expired | 2009-12-01 to 2019-11-01 | 2.5.29.32.0 | - | - | clean |
| 10 | countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking | yes | revoked, expired | 2009-12-01 to 2019-11-02 | 2.5.29.32.0 | - | - | clean |
| 11 | countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking | yes | revoked, expired | 2009-12-01 to 2019-11-02 | 2.5.29.32.0 | - | - | clean |
| 12 | countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group CA - G1 | yes | revoked | 2011-09-29 to 2026-09-29 | 2.5.29.32.0 | - | - | clean |
| 13 | countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group IS CA - G1 | yes | expired | 2011-10-27 to 2025-10-27 | - | - | - | historical errors: 1 |
| 14 | countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group SC CA - G1 | yes | expired | 2011-10-27 to 2025-10-27 | - | - | - | historical errors: 1 |
| 15 | countryName=CH, organizationName=Helsana Gruppe, commonName=Helsana Gruppe Service ICA 01 | yes | revoked, expired | 2011-03-21 to 2023-03-21 | 2.5.29.32.0 | 0 | - | clean |
| 16 | countryName=CH, stateOrProvinceName=Vaud, localityName=Vevey, organizationName=Nestle, organizationalUnitName=IS/IT, commonName=Nestle External CA, emailAddress=pki-security-ext@nestle.com | yes | revoked, expired | 2011-02-10 to 2018-02-10 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 17 | countryName=CH, organizationName=Die Schweizerische Post, organizationalUnitName=PROD, commonName=PKI SwissPost EXT Machine CA | yes | revoked, expired | 2011-04-06 to 2026-04-02 | 2.5.29.32.0 | 0 | - | clean |
| 18 | countryName=CH, organizationName=Die Schweizerische Post, organizationalUnitName=TEST, commonName=PKI SwissPost EXT Machine CA TEST | yes | revoked, expired | 2011-04-06 to 2026-04-02 | 2.5.29.32.0 | 0 | - | clean |
| 19 | countryName=CH, organizationName=SwissSign AG, commonName=Swiss Post Platinum CA 2008 - G2 | yes | revoked, expired | 2008-07-22 to 2023-07-22 | 2.16.756.1.89.1.1.1.4.3 | 0 | - | clean |
| 20 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Advanced Platinum CA 2019 - G22, organizationIdentifier=NTRCH-CHE-109.357.012 | yes | current | 2019-11-12 to 2034-11-12 | 2.16.756.1.89.1.1.1.1.10 | 0 | - | clean |
| 21 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Person Gold CA 2017 - G22, organizationIdentifier=NTRCH-CHE-109.357.012 | yes | revoked | 2017-12-18 to 2032-12-18 | 2.16.756.1.89.1.2.1.9 | 0 | - | clean |
| 22 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Person Platinum CA 2017 - G22, organizationIdentifier=NTRCH-CHE-109.357.012 | yes | current | 2017-12-18 to 2032-12-18 | 2.16.756.1.89.1.1.1.1.7 | 0 | - | clean |
| 23 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Qualified Platinum CA 2017 - G22, organizationIdentifier=NTRCH-CHE-109.357.012 | yes | revoked | 2017-12-18 to 2032-12-18 | 2.16.756.1.89.1.1.1.1.7 | 0 | - | clean |
| 24 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Qualified Platinum CA 2017 - G22 17-1, organizationIdentifier=NTRCH-CHE-109.357.012 | yes | revoked | 2017-12-18 to 2032-12-18 | 2.16.756.1.89.1.1.1.1.7 | 0 | - | clean |
| 25 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign EV Gold CA 2008 - G2 | yes | revoked, expired | 2008-11-13 to 2023-11-13 | 2.5.29.32.0 | 0 | - | clean |
| 26 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign EV Gold CA 2009 - G2 | yes | revoked, expired | 2009-06-10 to 2024-06-06 | 2.5.29.32.0 | 0 | - | clean |
| 27 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign EV Gold CA 2014 - G22 | yes | revoked | 2014-09-15 to 2035-03-04 | 2.5.29.32.0 | 0 | - | clean |
| 28 | countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum Person CA 2017 - G22, organizationIdentifier=NTRL-FL-0002.523.017-8 | yes | revoked | 2017-06-27 to 2032-06-27 | 2.16.756.1.89.1.1.7.1.2 | 0 | - | clean |
| 29 | countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum Person CA 2017 - G3, organizationIdentifier=NTRL-FL-0002.523.017-8 | yes | revoked | 2017-06-27 to 2032-06-27 | 2.16.756.1.89.1.1.7.1.2 | 0 | - | clean |
| 30 | countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum Server CA 2017 - G22, organizationIdentifier=NTRL-FL-0002.523.017-8 | yes | revoked | 2017-06-27 to 2032-06-27 | 2.16.756.1.89.1.1.7.1.2 | 0 | - | clean |
| 31 | countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum TSA CA 2017 - G3, organizationIdentifier=NTRL-FL-0002.523.017-8 | yes | revoked | 2017-06-27 to 2032-06-27 | 2.16.756.1.89.1.1.7.1.2 | 0 | Time Stamping | clean |
| 32 | countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Qualified Platinum CA 2016 - G22 | yes | revoked | 2016-06-15 to 2036-10-25 | 2.16.756.1.89.1.1.7.1 | 0 | - | historical errors: 1 |
| 33 | countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI TSA Platinum CA 2017 - G22, organizationIdentifier=NTRL-FL-0002.523.017-8 | yes | revoked | 2017-06-27 to 2032-06-27 | 2.16.756.1.89.1.1.7.1.2 | 0 | - | clean |
| 34 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Gold CA 2008 - G2 | yes | revoked, expired | 2008-07-07 to 2023-07-07 | 2.16.756.1.89.1.2.1.3 | 0 | - | clean |
| 35 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Gold CA 2014 - G22 | yes | revoked | 2014-09-19 to 2029-09-15 | 2.16.756.1.89.1.2.1.6 | 0 | - | clean |
| 36 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Gold CA 2014 - G22 | yes | revoked | 2014-09-15 to 2029-09-11 | 2.16.756.1.89.1.2.1.4 | 0 | - | clean |
| 37 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Platinum CA 2008 - G2 | yes | revoked, expired | 2008-07-07 to 2023-07-07 | 2.16.756.1.89.1.1.1.3.2 | 0 | - | clean |
| 38 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Platinum CA 2010 - G2 | yes | expired | 2010-07-05 to 2025-07-01 | 2.5.29.32.0 | 0 | - | clean |
| 39 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Platinum CA 2014 - G22 | yes | current | 2014-09-15 to 2029-09-11 | 2.5.29.32.0 | 0 | - | clean |
| 40 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Silver CA 2008 - G2 | yes | revoked, expired | 2008-07-09 to 2023-07-09 | 2.16.756.1.89.1.3.1.3 | 0 | - | clean |
| 41 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Silver CA 2014 - G22 | yes | revoked | 2014-09-15 to 2029-09-11 | 2.16.756.1.89.1.3.1.4 | 0 | - | clean |
| 42 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Silver CA 2014 - G22 | yes | revoked | 2014-09-19 to 2029-09-15 | 2.16.756.1.89.1.3.1.6 | 0 | - | clean |
| 43 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign PSS Qualified Platinum CA 2013 - G2 | yes | revoked | 2013-12-09 to 2028-12-05 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 44 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA 2008 - G2 | yes | revoked, expired | 2008-07-07 to 2023-07-07 | 2.16.756.1.89.1.1.1.2.2 | 0 | - | clean |
| 45 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA 2010 - G2 | yes | revoked, expired | 2010-01-27 to 2025-01-23 | 2.16.756.1.89.1.1.1.1.3 | 0 | - | clean |
| 46 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA 2010 - G2 | yes | revoked, expired | 2010-04-06 to 2025-04-02 | 2.5.29.32.0 | 0 | - | clean |
| 47 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA G22 16-1 | yes | revoked | 2016-09-13 to 2031-09-10 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 48 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME LCP 2021 - 1 | yes | revoked | 2021-08-03 to 2036-07-30 | 2.16.756.1.89.2.1.11, 0.4.0.2042.1.3 | 0 | E-mail Protection | clean |
| 49 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME LCP ICA 2021 - 2 | yes | current | 2021-08-04 to 2036-07-31 | 2.16.756.1.89.2.1.11, 0.4.0.2042.1.3 | 0 | E-mail Protection | clean |
| 50 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME LCP ICA 2022 - 1 | yes | current | 2022-06-29 to 2036-06-29 | 0.4.0.2042.1.3, 2.16.756.1.89.2.1.11 | 0 | E-mail Protection | clean |
| 51 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME MV ICA 2024 - 1 | yes | current | 2024-05-28 to 2036-05-28 | 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 0.4.0.2042.1.3, 2.16.756.1.89.2.1.11 | 0 | E-mail Protection | current errors: 1 |
| 52 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP extended ICA 2021 - 1 | yes | current | 2021-08-03 to 2036-07-30 | 2.16.756.1.89.2.1.13, 0.4.0.2042.1.1 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 53 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP extended ICA 2022 - 1 | yes | current | 2022-06-29 to 2036-06-29 | 0.4.0.2042.1.1, 2.16.756.1.89.2.1.13 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login | clean |
| 54 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP ICA 2021 - 1 | yes | current | 2021-08-03 to 2036-07-30 | 2.16.756.1.89.2.1.12, 0.4.0.2042.1.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 55 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP ICA 2022 - 1 | yes | current | 2022-06-29 to 2036-06-29 | 0.4.0.2042.1.1, 2.16.756.1.89.2.1.12 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 56 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME OV ICA 2024 - 1 | yes | current | 2024-05-28 to 2036-05-28 | 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 0.4.0.2042.1.1, 2.16.756.1.89.2.1.14 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 57 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1 | yes | current | 2021-08-03 to 2036-10-23 | - | - | - | current errors: 3 |
| 58 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1 | yes | current | 2021-08-02 to 2046-07-27 | - | - | - | clean |
| 59 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1 | yes | current | 2022-06-08 to 2047-06-08 | - | - | - | clean |
| 60 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1 | yes | current | 2022-06-28 to 2036-09-22 | 2.5.29.32.0 | - | - | current errors: 2 |
| 61 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME SV ICA 2024 - 1 | yes | current | 2024-05-28 to 2036-05-28 | 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 0.4.0.2042.1.1, 2.16.756.1.89.2.1.12, 2.16.756.1.89.2.1.13 | 0 | TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System | clean |
| 62 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME SV ICA 2026 - 1 | yes | current | 2026-06-10 to 2031-06-10 | 2.23.140.1.5.3.3, 2.16.756.1.89.2.1.12, 0.4.0.2042.1.1 | 0 | E-mail Protection | clean |
| 63 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS DV ICA 2021 - 1 | yes | revoked | 2021-08-03 to 2036-07-30 | 2.16.756.1.89.2.1.1, 2.23.140.1.2.1, 0.4.0.2042.1.6 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 64 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS DV ICA 2022 - 1 | yes | current | 2022-06-29 to 2036-06-29 | 2.23.140.1.2.1, 0.4.0.2042.1.6, 2.16.756.1.89.2.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 65 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS DV ICA 2026 - 1 | yes | current | 2026-06-10 to 2029-06-10 | 2.23.140.1.2.1, 0.4.0.2042.1.6, 2.16.756.1.89.2.1.1 | 0 | TLS Web Server Authentication | clean |
| 66 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS EV ICA 2021 - 1 | yes | revoked | 2021-08-03 to 2036-07-30 | 2.16.756.1.89.2.1.3, 2.23.140.1.1, 0.4.0.2042.1.4 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 67 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS EV ICA 2022 - 1 | yes | current | 2022-06-29 to 2036-06-29 | 2.23.140.1.1, 0.4.0.2042.1.4, 2.16.756.1.89.2.1.3 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 68 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS EV ICA 2026 - 1 | yes | current | 2026-06-10 to 2029-06-10 | 2.23.140.1.1, 0.4.0.2042.1.4, 2.16.756.1.89.2.1.3 | 0 | TLS Web Server Authentication | clean |
| 69 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS OV ICA 2021 - 1 | yes | revoked | 2021-08-03 to 2036-07-30 | 2.16.756.1.89.2.1.2, 2.23.140.1.2.2, 0.4.0.2042.1.7 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 70 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS OV ICA 2022 - 1 | yes | current | 2022-06-29 to 2036-06-29 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 2.16.756.1.89.2.1.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 71 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS OV ICA 2026 - 1 | yes | current | 2026-06-10 to 2029-06-10 | 2.23.140.1.2.2, 0.4.0.2042.1.7, 2.16.756.1.89.2.1.2 | 0 | TLS Web Server Authentication | clean |
| 72 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1 | yes | revoked | 2021-08-03 to 2036-10-23 | - | - | - | historical errors: 3 |
| 73 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1 | yes | revoked | 2021-08-02 to 2046-07-27 | - | - | - | clean |
| 74 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1 | yes | current | 2022-06-28 to 2036-09-22 | 2.5.29.32.0 | - | - | current errors: 2 |
| 75 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1 | yes | current | 2022-06-08 to 2047-06-08 | - | - | - | clean |
| 76 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Gold CA 2008 - G2 | yes | revoked, expired | 2008-07-07 to 2023-07-07 | 2.16.756.1.89.1.2.1.3 | 0 | - | clean |
| 77 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Gold CA 2014 - G22 | yes | revoked | 2014-09-15 to 2029-09-11 | 2.16.756.1.89.1.2.1.4 | 0 | - | clean |
| 78 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Gold CA 2014 - G22 | yes | revoked | 2014-09-19 to 2029-09-15 | 2.16.756.1.89.1.2.1.6 | 0 | - | clean |
| 79 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Silver CA 2008 - G2 | yes | revoked, expired | 2008-07-07 to 2023-07-07 | 2.16.756.1.89.1.3.1.3 | 0 | - | clean |
| 80 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Silver CA 2014 - G22 | yes | revoked | 2014-09-15 to 2029-09-11 | 2.16.756.1.89.1.3.1.4 | 0 | - | clean |
| 81 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Silver CA 2014 - G22 | yes | revoked | 2014-09-19 to 2029-09-15 | 2.16.756.1.89.1.3.1.6 | 0 | - | clean |
| 82 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign SuisseID Platinum CA 2010 - G2 | yes | revoked, expired | 2010-03-08 to 2025-03-04 | 2.5.29.32.0 | 0 | - | clean |
| 83 | countryName=CH, organizationName=SwissSign AG, commonName=SwissSign SuisseID Platinum CA 2014 - G22 | yes | revoked | 2014-09-15 to 2029-09-11 | 2.5.29.32.0 | 0 | - | clean |
| 84 | countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Gold CA | yes | expired | 2011-09-29 to 2017-11-01 | 2.5.29.32.0 | - | - | clean |
| 85 | countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Gold CA | yes | revoked, expired | 2009-12-01 to 2019-11-01 | 2.5.29.32.0 | - | - | clean |
| 86 | countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Gold CA | yes | revoked, expired | 2009-12-01 to 2019-11-02 | 2.5.29.32.0 | - | - | clean |
| 87 | countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Silver CA | yes | revoked, expired | 2009-12-01 to 2019-11-02 | 2.5.29.32.0 | - | - | clean |
| 88 | countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Silver CA | yes | expired | 2011-09-29 to 2017-11-01 | 2.5.29.32.0 | - | - | clean |

## Certificate Details

### SwissSign Gold CA - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: BB401C43F55E4FB0
- SHA-256: 62DD0BE9B9F50A163EA0F8E75C053B1ECA57EA55C8688F647C6881F2C8357B95
- SPKI SHA-256: 40FCFC28875DCCBFEBCBDF6CD7433312DA63C4EFCF3BD7B1B505C22020AE0274
- Validity: 2006-10-25 to 2036-10-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.swisssign.com/SwissSign_CP_LCP.pdf; https://repository.swisssign.com/SwissSign_CP_NCP_extended.pdf; https://repository.swisssign.com/SwissSign_CP_NCP.pdf; https://repository.swisssign.com/SwissSign_CP_SMIME_OV.pdf; https://repository.swisssign.com/SwissSign_CP_LCP.pdf; https://repository.swisssign.com/SwissSign_CP_NCP_extended.pdf; https://repository.swisssign.com/SwissSign_CP_NCP.pdf; https://repository.swisssign.com/SwissSign_CP_SMIME_OV.pdf, https://repository.swisssign.com/SwissSign_CPS_SMIME.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_SMIME.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_SMIME.pdf, https://repository.swisssign.com/SwissSign_CPCPS_TLS.pdf?_gl=1*b7k2k4*_gcl_au*NDc0OTQ3OTYwLjE3Nzg1NzMzODY.
- CP/CPS same as parent: false
- Audit URLs: https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091201_SwissSign_Standard_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091202_SwissSign_TLS-BR_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091203_SwissSign_TLS-EV_Audit.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2025/09/AA2025091204_V2_SwissSign_SMIME-BR_Audit_25.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bb:40:1c:43:f5:5e:4f:b0
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Oct 25 08:30:35 2006 GMT
            Not After : Oct 25 08:30:35 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.1
                  CPS: http://repository.swisssign.com/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 62DD0BE9B9F50A163EA0F8E75C053B1ECA57EA55C8688F647C6881F2C8357B95
    SPKI SHA256: 40FCFC28875DCCBFEBCBDF6CD7433312DA63C4EFCF3BD7B1B505C22020AE0274
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### SwissSign Gold Root CA - G3

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold Root CA - G3
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold Root CA - G3
- Serial: DEC4F244F31DA6FC
- SHA-256: 7AF6EA9F753A1E709BD64D0BEB867C11E8C295A56E24A6E0471459DCCDAA1558
- SPKI SHA-256: 7F1DEC8B0319548A056DE5BB521BD93EB74E6A76F28DFFB75B45A53B775AF7AB
- Validity: 2009-08-04 to 2037-08-04
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2017113002_Browser_Audit_Atesttation_s.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            de:c4:f2:44:f3:1d:a6:fc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold Root CA - G3
        Validity
            Not Before: Aug  4 13:31:47 2009 GMT
            Not After : Aug  4 13:31:47 2037 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Gold Root CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                5C:97:06:46:34:AB:DF:30:C5:7C:C5:0D:55:71:66:30:B5:60:8F:9E
            X509v3 Authority Key Identifier:
                5C:97:06:46:34:AB:DF:30:C5:7C:C5:0D:55:71:66:30:B5:60:8F:9E
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7AF6EA9F753A1E709BD64D0BEB867C11E8C295A56E24A6E0471459DCCDAA1558
    SPKI SHA256: 7F1DEC8B0319548A056DE5BB521BD93EB74E6A76F28DFFB75B45A53B775AF7AB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SwissSign Platinum CA - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 4EB200670C035D4F
- SHA-256: 3B222E566711E992300DC0B15AB9473DAFDEF8C84D0CEF7D3317B4C1821D1436
- SPKI SHA-256: 2A8BED32AE680D2D187B9A7AFD171D83FD0B935EAF9E2C1B43E80278D2063E39
- Validity: 2006-10-25 to 2036-10-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://it-tuv.com/en/wp-content/uploads/sites/10/2022/12/AA2022113007_Audit_Attestation_SwissSign_Platinum_CA-G2.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- Revocation status: -
- Browser status: {"apple":"Removed","chrome":"Not Included","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5670595323396054351 (0x4eb200670c035d4f)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Oct 25 08:36:00 2006 GMT
            Not After : Oct 25 08:36:00 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.1
                  CPS: http://repository.swisssign.com/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3B222E566711E992300DC0B15AB9473DAFDEF8C84D0CEF7D3317B4C1821D1436
    SPKI SHA256: 2A8BED32AE680D2D187B9A7AFD171D83FD0B935EAF9E2C1B43E80278D2063E39
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### SwissSign Platinum Root CA - G3

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum Root CA - G3
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum Root CA - G3
- Serial: 223FA91720DE8194
- SHA-256: 59B3829F1FF443344958FAE8BFF621B684C848CFBF7EAD6B63A6CA50F2794F89
- SPKI SHA-256: 8A903B600A080B38DFE20DFB6ACD23122F64620E5808B9FC8688952FC1A3559C
- Validity: 2009-08-04 to 2037-08-04
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8861552
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2467877037623116180 (0x223fa91720de8194)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum Root CA - G3
        Validity
            Not Before: Aug  4 13:34:04 2009 GMT
            Not After : Aug  4 13:34:04 2037 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Platinum Root CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                56:2A:3F:90:58:F4:17:5A:14:B2:D7:08:1B:85:5B:54:6A:54:1A:28
            X509v3 Authority Key Identifier:
                56:2A:3F:90:58:F4:17:5A:14:B2:D7:08:1B:85:5B:54:6A:54:1A:28
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 59B3829F1FF443344958FAE8BFF621B684C848CFBF7EAD6B63A6CA50F2794F89
    SPKI SHA256: 8A903B600A080B38DFE20DFB6ACD23122F64620E5808B9FC8688952FC1A3559C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### SwissSign Silver CA - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 4F1BD42F54BB2F4B
- SHA-256: BE6C4DA2BBB9BA59B6F3939768374246C3C005993FA98F020D1DEDBED48A81D5
- SPKI SHA-256: 9318226F8C83AFE47F5F47C24F59CE12DBA8C73B181BEE6B2EA1F40A06BC1869
- Validity: 2006-10-25 to 2036-10-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.swisssign.com/SwissSign_CP_LCP.pdf, https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf; https://repository.swisssign.com/SwissSign_CPS_TLS.pdf
- CP/CPS same as parent: false
- Audit URLs: https://it-tuv.com/wp-content/uploads/2024/09/AA2024090401_SwissSign_Standard_Audit_V1.0.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2024/09/AA2024090402_SwissSign_TLS-BR_Audit_V2.0.pdf, https://it-tuv.com/en/wp-content/uploads/sites/10/2024/09/AA2024090404_SwissSign_SMIME-BR_Audit_V2.0.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"NotBefore","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5700383053117599563 (0x4f1bd42f54bb2f4b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Oct 25 08:32:46 2006 GMT
            Not After : Oct 25 08:32:46 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.1
                  CPS: http://repository.swisssign.com/
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: BE6C4DA2BBB9BA59B6F3939768374246C3C005993FA98F020D1DEDBED48A81D5
    SPKI SHA256: 9318226F8C83AFE47F5F47C24F59CE12DBA8C73B181BEE6B2EA1F40A06BC1869
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.1
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls

### SwissSign Silver Root CA - G3

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver Root CA - G3
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver Root CA - G3
- Serial: AA88B05A0BB1769B
- SHA-256: 1E49AC5DC69E86D0565DA2C1305C419330B0B781BFEC50E54A1B35AF7FDDD501
- SPKI SHA-256: 84AAC093E08C49DBFFF8E560759248DBE67135B372B23D2A881D5F99CBB191E8
- Validity: 2009-08-04 to 2037-08-04
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://bugzilla.mozilla.org/attachment.cgi?id=8861552
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            aa:88:b0:5a:0b:b1:76:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver Root CA - G3
        Validity
            Not Before: Aug  4 13:19:14 2009 GMT
            Not After : Aug  4 13:19:14 2037 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Silver Root CA - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                A1:8C:45:93:0A:12:63:0B:A7:57:5F:32:4A:7D:E1:21:E7:B7:3E:66
            X509v3 Authority Key Identifier:
                A1:8C:45:93:0A:12:63:0B:A7:57:5F:32:4A:7D:E1:21:E7:B7:3E:66
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1E49AC5DC69E86D0565DA2C1305C419330B0B781BFEC50E54A1B35AF7FDDD501
    SPKI SHA256: 84AAC093E08C49DBFFF8E560759248DBE67135B372B23D2A881D5F99CBB191E8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### AffirmTrust Commercial

- Subject: countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Commercial
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 272B67229745D2438BF9774186AEBD
- SHA-256: B102959F862B71B78EFDC7FA9F43B3AFD7E52312A07493A752835B991D840F4C
- SPKI SHA-256: 6C464B9A5B233A5E874DA765C26F045010D2DDCFF45794F0B4C7E4AAFA501495
- Validity: 2009-12-01 to 2019-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: CPS: http://www.affirmtrust.com/resources/cps, CPS: http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:2b:67:22:97:45:d2:43:8b:f9:77:41:86:ae:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Dec  1 00:00:00 2009 GMT
            Not After : Nov  2 00:00:00 2019 GMT
        Subject: C = US, O = AffirmTrust, CN = AffirmTrust Commercial
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                9D:93:C6:53:8B:5E:CA:AF:3F:9F:1E:0F:E5:99:95:BC:24:F6:94:8F
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B102959F862B71B78EFDC7FA9F43B3AFD7E52312A07493A752835B991D840F4C
    SPKI SHA256: 6C464B9A5B233A5E874DA765C26F045010D2DDCFF45794F0B4C7E4AAFA501495
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### AffirmTrust Networking

- Subject: countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 9414004B9451039D57008018423F31
- SHA-256: 671A97861D242968A77EB6FE382BDEF0C6D2E25D99D23202ACD13FE9BBCDCF48
- SPKI SHA-256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
- Validity: 2011-09-29 to 2017-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: CPS: http://www.affirmtrust.com/resources/cps, CPS: http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=1894&file=pdf, https://cert.webtrust.org/SealFile?seal=1896&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            94:14:00:4b:94:51:03:9d:57:00:80:18:42:3f:31
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 29 20:45:04 2011 GMT
            Not After : Nov  1 20:45:04 2017 GMT
        Subject: C = US, O = AffirmTrust, CN = AffirmTrust Networking
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                07:1F:D2:E7:9C:DA:C2:6E:A2:40:B4:B0:7A:50:10:50:74:C4:C8:BD
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 671A97861D242968A77EB6FE382BDEF0C6D2E25D99D23202ACD13FE9BBCDCF48
    SPKI SHA256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### AffirmTrust Networking

- Subject: countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 843C74B1AA3486B1C4C7A0DF55B5E9
- SHA-256: 3A612C8EE7D827032487A1FC4D7FE8296853595305571B68F94415C3D33E7A35
- SPKI SHA-256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
- Validity: 2009-12-01 to 2019-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:3c:74:b1:aa:34:86:b1:c4:c7:a0:df:55:b5:e9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Dec  1 12:00:00 2009 GMT
            Not After : Nov  1 12:00:00 2019 GMT
        Subject: C = US, O = AffirmTrust, CN = AffirmTrust Networking
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                07:1F:D2:E7:9C:DA:C2:6E:A2:40:B4:B0:7A:50:10:50:74:C4:C8:BD
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3A612C8EE7D827032487A1FC4D7FE8296853595305571B68F94415C3D33E7A35
    SPKI SHA256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### AffirmTrust Networking

- Subject: countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 843C74B1AA3486B1C4C7A0DF55B5E9
- SHA-256: F2D15E3A4872DFE9AE9114DC19B1B436614BE08486A61069E6787E81D86A12C4
- SPKI SHA-256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
- Validity: 2009-12-01 to 2019-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:3c:74:b1:aa:34:86:b1:c4:c7:a0:df:55:b5:e9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Dec  1 12:00:00 2009 GMT
            Not After : Nov  2 07:03:18 2019 GMT
        Subject: C = US, O = AffirmTrust, CN = AffirmTrust Networking
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                07:1F:D2:E7:9C:DA:C2:6E:A2:40:B4:B0:7A:50:10:50:74:C4:C8:BD
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F2D15E3A4872DFE9AE9114DC19B1B436614BE08486A61069E6787E81D86A12C4
    SPKI SHA256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### AffirmTrust Networking

- Subject: countryName=US, organizationName=AffirmTrust, commonName=AffirmTrust Networking
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 83551BD2384F68E04205B837D48D87
- SHA-256: 3156CB7FE72C051B5AFB2C17F5AEA75AF810D04A0757293974925ECE5356DFC4
- SPKI SHA-256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
- Validity: 2009-12-01 to 2019-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: CPS: http://www.affirmtrust.com/resources/cps, CPS: http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=1894&file=pdf, https://cert.webtrust.org/SealFile?seal=1896&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:55:1b:d2:38:4f:68:e0:42:05:b8:37:d4:8d:87
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Dec  1 12:00:00 2009 GMT
            Not After : Nov  2 07:03:39 2019 GMT
        Subject: C = US, O = AffirmTrust, CN = AffirmTrust Networking
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                07:1F:D2:E7:9C:DA:C2:6E:A2:40:B4:B0:7A:50:10:50:74:C4:C8:BD
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 3156CB7FE72C051B5AFB2C17F5AEA75AF810D04A0757293974925ECE5356DFC4
    SPKI SHA256: 94072AD3F58F70F93098E5A5F6C04C96C710BD849D83184919AE90EB890AE400
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### DOUGLAS Group CA - G1

- Subject: countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group CA - G1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 6815ECBF4A14DF1AA1DB19143CE8BC
- SHA-256: C12E3333F5A4D4C2A9F364995E581FA02FC7EFF16F37C373ACF81CDABE04B49A
- SPKI SHA-256: 2E90775A53F650FBFFDF222CD3928971A4DFF23F6A97477D537ABF385229F14A
- Validity: 2011-09-29 to 2026-09-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:15:ec:bf:4a:14:df:1a:a1:db:19:14:3c:e8:bc
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 29 12:45:15 2011 GMT
            Not After : Sep 29 12:45:15 2026 GMT
        Subject: C = DE, O = DOUGLAS Holding AG, CN = DOUGLAS Group CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                C4:36:C3:7E:51:F4:C6:1F:15:49:C2:78:24:AC:DC:CF:DB:83:49:1F
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://pki.dhag.net/GroupCA/CP-CPS-G1.pdf
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: C12E3333F5A4D4C2A9F364995E581FA02FC7EFF16F37C373ACF81CDABE04B49A
    SPKI SHA256: 2E90775A53F650FBFFDF222CD3928971A4DFF23F6A97477D537ABF385229F14A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- expires_within_398_days

### DOUGLAS Group IS CA - G1

- Subject: countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group IS CA - G1
- Issuer: countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group CA - G1
- Serial: 1F331D1C000000000005
- SHA-256: F2981A4FEB8EF1D93781F79138C9F3B454A9E2A74AE9F736B15F51B5E38326D2
- SPKI SHA-256: 871CCD070EA62A57B0F1340B140FF3B4F426165CCE3CC0389763DF502D5B6484
- Validity: 2011-10-27 to 2025-10-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crl, ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:33:1d:1c:00:00:00:00:00:05
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DOUGLAS Holding AG, CN = DOUGLAS Group CA - G1
        Validity
            Not Before: Oct 27 15:25:37 2011 GMT
            Not After : Oct 27 15:35:37 2025 GMT
        Subject: C = DE, O = DOUGLAS Holding AG, CN = DOUGLAS Group IS CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                FB:B0:E1:6C:F1:3E:F8:DE:50:67:AD:15:FD:7B:05:B8:65:03:4B:25
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Key Usage:
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                C4:36:C3:7E:51:F4:C6:1F:15:49:C2:78:24:AC:DC:CF:DB:83:49:1F
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crl
                  URI:ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=rd,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint
            Authority Information Access:
                CA Issuers - URI:http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crt
                CA Issuers - URI:ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=rd,DC=local?cACertificate?base?objectClass=certificationAuthority
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F2981A4FEB8EF1D93781F79138C9F3B454A9E2A74AE9F736B15F51B5E38326D2
    SPKI SHA256: 871CCD070EA62A57B0F1340B140FF3B4F426165CCE3CC0389763DF502D5B6484
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crt, ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1
- CRL Distribution Points: http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crl, ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### DOUGLAS Group SC CA - G1

- Subject: countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group SC CA - G1
- Issuer: countryName=DE, organizationName=DOUGLAS Holding AG, commonName=DOUGLAS Group CA - G1
- Serial: 1F42A7CF000000000006
- SHA-256: A9EF57D75388BBEAC85627881A55945E3E6122DE0D7D39169A6CEEA54C700922
- SPKI SHA-256: CB4AF313566E91986BAE6618EC5FB24A6055758407BF3E95FD9EDF4753FFBBBF
- Validity: 2011-10-27 to 2025-10-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Parent Cert Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crl, ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:42:a7:cf:00:00:00:00:00:06
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = DE, O = DOUGLAS Holding AG, CN = DOUGLAS Group CA - G1
        Validity
            Not Before: Oct 27 15:42:35 2011 GMT
            Not After : Oct 27 15:52:35 2025 GMT
        Subject: C = DE, O = DOUGLAS Holding AG, CN = DOUGLAS Group SC CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1:
                ...
            X509v3 Subject Key Identifier:
                92:C1:64:55:DF:4B:24:0F:18:96:D5:F6:F1:E5:2C:7E:B1:C1:01:4D
            1.3.6.1.4.1.311.20.2:
                .
.S.u.b.C.A
            X509v3 Key Usage:
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                C4:36:C3:7E:51:F4:C6:1F:15:49:C2:78:24:AC:DC:CF:DB:83:49:1F
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crl
                  URI:ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=rd,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint
            Authority Information Access:
                CA Issuers - URI:http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crt
                CA Issuers - URI:ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=rd,DC=local?cACertificate?base?objectClass=certificationAuthority
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A9EF57D75388BBEAC85627881A55945E3E6122DE0D7D39169A6CEEA54C700922
    SPKI SHA256: CB4AF313566E91986BAE6618EC5FB24A6055758407BF3E95FD9EDF4753FFBBBF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crt, ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1
- CRL Distribution Points: http://pki.dhag.net/GroupCA/DOUGLAS_Group_CA_G1.crl, ldap:///CN=DOUGLAS%20Group%20CA%20-%20G1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### Helsana Gruppe Service ICA 01

- Subject: countryName=CH, organizationName=Helsana Gruppe, commonName=Helsana Gruppe Service ICA 01
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: F8B20979B0014ABEF790D86B70E61B
- SHA-256: D8B9EC672715CC5B566669CBC643ECCCAE1A30E26974DCE952456026D07945DD
- SPKI SHA-256: EF163FB65F2FE9278DE728D1E211B671DF8D9AC601941FB21D8EE057570E95AA
- Validity: 2011-03-21 to 2023-03-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://silver-root-g2.ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f8:b2:09:79:b0:01:4a:be:f7:90:d8:6b:70:e6:1b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Mar 21 14:10:35 2011 GMT
            Not After : Mar 21 14:10:35 2023 GMT
        Subject: C = CH, O = Helsana Gruppe, CN = Helsana Gruppe Service ICA 01
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                64:50:00:EB:B6:7B:32:63:C4:02:2F:0C:DF:49:21:76:F9:FF:60:F2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS-R5.pdf
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                OCSP - URI:http://silver-root-g2.ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D8B9EC672715CC5B566669CBC643ECCCAE1A30E26974DCE952456026D07945DD
    SPKI SHA256: EF163FB65F2FE9278DE728D1E211B671DF8D9AC601941FB21D8EE057570E95AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://silver-root-g2.ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Nestle External CA

- Subject: countryName=CH, stateOrProvinceName=Vaud, localityName=Vevey, organizationName=Nestle, organizationalUnitName=IS/IT, commonName=Nestle External CA, emailAddress=pki-security-ext@nestle.com
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 867A5AAFF875E150CF00BA36716950
- SHA-256: B321B97DA80A044609D37C6F9F1071084DF38A599CCA8888097534DCFE4F95F9
- SPKI SHA-256: 853E74B2E9666018478115F2C3EC4A37213428AB8E2A1C94BDD3622B80177C94
- Validity: 2011-02-10 to 2018-02-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:7a:5a:af:f8:75:e1:50:cf:00:ba:36:71:69:50
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Feb 10 08:22:17 2011 GMT
            Not After : Feb 10 08:22:17 2018 GMT
        Subject: C = CH, ST = Vaud, L = Vevey, O = Nestle, OU = IS/IT, CN = Nestle External CA, emailAddress = pki-security-ext@nestle.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AB:12:9A:D0:62:96:3B:A6:95:83:EE:54:26:A8:CD:D7:6F:71:0B:E2
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            Authority Information Access:
                OCSP - URI:http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R5.pdf
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B321B97DA80A044609D37C6F9F1071084DF38A599CCA8888097534DCFE4F95F9
    SPKI SHA256: 853E74B2E9666018478115F2C3EC4A37213428AB8E2A1C94BDD3622B80177C94
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_subj_email_not_in_san: At least one email address in the Subject does not appear in the SAN

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PKI SwissPost EXT Machine CA

- Subject: countryName=CH, organizationName=Die Schweizerische Post, organizationalUnitName=PROD, commonName=PKI SwissPost EXT Machine CA
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 9584E2414091440359AFE94E01EADB
- SHA-256: 2DF0597BD3395F54116BA21FA397F5AE8916F8E3BA7719B0EDB54F2BA250DB1C
- SPKI SHA-256: 7E7D1022A26066375F44B74F7784A687560BFA7E9636C476522E9840A64B1ADE
- Validity: 2011-04-06 to 2026-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            95:84:e2:41:40:91:44:03:59:af:e9:4e:01:ea:db
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Apr  6 12:40:32 2011 GMT
            Not After : Apr  2 12:40:32 2026 GMT
        Subject: C = CH, O = Die Schweizerische Post, OU = PROD, CN = PKI SwissPost EXT Machine CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                C3:E2:9A:34:FB:79:B3:63:36:83:5F:B5:83:6D:16:65:AC:12:3E:E2
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R5.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2DF0597BD3395F54116BA21FA397F5AE8916F8E3BA7719B0EDB54F2BA250DB1C
    SPKI SHA256: 7E7D1022A26066375F44B74F7784A687560BFA7E9636C476522E9840A64B1ADE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### PKI SwissPost EXT Machine CA TEST

- Subject: countryName=CH, organizationName=Die Schweizerische Post, organizationalUnitName=TEST, commonName=PKI SwissPost EXT Machine CA TEST
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 5EDC6C72FB236A09AC8C39AD86216D
- SHA-256: D263F0E43414EB88C4D4D858924B07A4A592654FB99E47BECFC66669BB8E3DB9
- SPKI SHA-256: B7507CB45BEE7BC26F9A41964D614C80E595675967FCF39FF64B9870D1716D99
- Validity: 2011-04-06 to 2026-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:dc:6c:72:fb:23:6a:09:ac:8c:39:ad:86:21:6d
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Apr  6 12:41:15 2011 GMT
            Not After : Apr  2 12:41:15 2026 GMT
        Subject: C = CH, O = Die Schweizerische Post, OU = TEST, CN = PKI SwissPost EXT Machine CA TEST
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                23:21:D1:E0:9A:06:98:74:CD:7B:E6:C5:ED:AF:87:6C:B9:F7:49:D9
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R5.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: D263F0E43414EB88C4D4D858924B07A4A592654FB99E47BECFC66669BB8E3DB9
    SPKI SHA256: B7507CB45BEE7BC26F9A41964D614C80E595675967FCF39FF64B9870D1716D99
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://gold-root-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Swiss Post Platinum CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=Swiss Post Platinum CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 849A25C4A47D0ABD
- SHA-256: 03CD118969720EA6A6979076C12CC1B5973BA6409CF3772D4BAD9225CB70D119
- SPKI SHA-256: 2F8EF4A9B026E55B631EA75C040103DB808C1B4F1D5FC0FCB20FA485382E2651
- Validity: 2008-07-22 to 2023-07-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.4.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:9a:25:c4:a4:7d:0a:bd
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jul 22 11:39:16 2008 GMT
            Not After : Jul 22 11:39:16 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = Swiss Post Platinum CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1B:A0:B3:A4:34:6A:96:96:D9:79:3E:2C:28:C6:DE:FD:85:36:FB:A4
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.4.3
                  CPS: http://repository.swisssign.com/Swiss-Post-Platinum-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 03CD118969720EA6A6979076C12CC1B5973BA6409CF3772D4BAD9225CB70D119
    SPKI SHA256: 2F8EF4A9B026E55B631EA75C040103DB808C1B4F1D5FC0FCB20FA485382E2651
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.4.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Advanced Platinum CA 2019 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Advanced Platinum CA 2019 - G22, organizationIdentifier=NTRCH-CHE-109.357.012
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: CEA6F34A5355EA0BD323F7583ACA18
- SHA-256: 9D7D1ABDDC9F23838B26C56B0A0FE6ADD5F0A6E398D8C0BCE712A438CE33B69B
- SPKI SHA-256: 03041FB36DAF733A245F6342E5D3D99FEF8996FC0DFD902FF9BEEC6FA3115BD0
- Validity: 2019-11-12 to 2034-11-12
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SwissSign AG
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/32A57E31D842DBBA2CB2FEE669099DB7DA90D210
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.10
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ce:a6:f3:4a:53:55:ea:0b:d3:23:f7:58:3a:ca:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Nov 12 09:31:35 2019 GMT
            Not After : Nov 12 09:31:35 2034 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Advanced Platinum CA 2019 - G22, organizationIdentifier = NTRCH-CHE-109.357.012
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                32:A5:7E:31:D8:42:DB:BA:2C:B2:FE:E6:69:09:9D:B7:DA:90:D2:10
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.1.10
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9D7D1ABDDC9F23838B26C56B0A0FE6ADD5F0A6E398D8C0BCE712A438CE33B69B
    SPKI SHA256: 03041FB36DAF733A245F6342E5D3D99FEF8996FC0DFD902FF9BEEC6FA3115BD0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.10
- AIA OCSP: http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign CH Person Gold CA 2017 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Person Gold CA 2017 - G22, organizationIdentifier=NTRCH-CHE-109.357.012
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: B369A35C8438C22E4794CBC081223E
- SHA-256: 0F406E947393BF050AA59B1B86FC0FBF7BAA6D469176FF52A7B085128280BD40
- SPKI SHA-256: FC9C141FF7A2C93EA3BADEBCC934492A6EE4E75B4D257959B006FE1062193357
- Validity: 2017-12-18 to 2032-12-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.9
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://gold-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b3:69:a3:5c:84:38:c2:2e:47:94:cb:c0:81:22:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Dec 18 06:23:29 2017 GMT
            Not After : Dec 18 06:23:29 2032 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign CH Person Gold CA 2017 - G22, organizationIdentifier = NTRCH-CHE-109.357.012
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                79:CB:06:7D:28:34:8F:ED:09:C4:C8:2C:DC:07:9D:21:43:2B:69:11
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.9
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://gold-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0F406E947393BF050AA59B1B86FC0FBF7BAA6D469176FF52A7B085128280BD40
    SPKI SHA256: FC9C141FF7A2C93EA3BADEBCC934492A6EE4E75B4D257959B006FE1062193357
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.9
- AIA OCSP: http://gold-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign CH Person Platinum CA 2017 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Person Platinum CA 2017 - G22, organizationIdentifier=NTRCH-CHE-109.357.012
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 6456CF80F9C7A0335437F537250705
- SHA-256: 3CC9509C0FBF0BBBFE2BAB0B4117811E95C58A37D7F6902DE67524A9FE07C040
- SPKI SHA-256: D2599A9DDAF66D5854C8255E1E4485E8A2CE2E36B71E5B2E9490148DD2D9B486
- Validity: 2017-12-18 to 2032-12-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/1EC8046DFB72625160A273246FBEF25F4D3492FC
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:56:cf:80:f9:c7:a0:33:54:37:f5:37:25:07:05
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Dec 18 06:25:36 2017 GMT
            Not After : Dec 18 06:25:36 2032 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign CH Person Platinum CA 2017 - G22, organizationIdentifier = NTRCH-CHE-109.357.012
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                1E:C8:04:6D:FB:72:62:51:60:A2:73:24:6F:BE:F2:5F:4D:34:92:FC
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.1.7
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 3CC9509C0FBF0BBBFE2BAB0B4117811E95C58A37D7F6902DE67524A9FE07C040
    SPKI SHA256: D2599A9DDAF66D5854C8255E1E4485E8A2CE2E36B71E5B2E9490148DD2D9B486
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.7
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign CH Qualified Platinum CA 2017 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Qualified Platinum CA 2017 - G22, organizationIdentifier=NTRCH-CHE-109.357.012
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: B8DF8370FAA54E76C088635A89BDAE
- SHA-256: 29CC90779084B25D2142AB1E9F52B6A4463765E86AB321C3293FEE51300E33B1
- SPKI SHA-256: 9C3CE03A303FCCE59EC3FFEF1939FE300AA40F81C7C04E8FE06CE640A9143813
- Validity: 2017-12-18 to 2032-12-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/54F05B520AD08C09DB07E5B6B7A6C275EBB8B905
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b8:df:83:70:fa:a5:4e:76:c0:88:63:5a:89:bd:ae
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Dec 18 06:31:59 2017 GMT
            Not After : Dec 18 06:31:59 2032 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign CH Qualified Platinum CA 2017 - G22, organizationIdentifier = NTRCH-CHE-109.357.012
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                54:F0:5B:52:0A:D0:8C:09:DB:07:E5:B6:B7:A6:C2:75:EB:B8:B9:05
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.1.7
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 29CC90779084B25D2142AB1E9F52B6A4463765E86AB321C3293FEE51300E33B1
    SPKI SHA256: 9C3CE03A303FCCE59EC3FFEF1939FE300AA40F81C7C04E8FE06CE640A9143813
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.7
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign CH Qualified Platinum CA 2017 - G22 17-1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign CH Qualified Platinum CA 2017 - G22 17-1, organizationIdentifier=NTRCH-CHE-109.357.012
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: F5889E21886117E255D645810556F8
- SHA-256: 78B08B7D449A53DEA551DBE9BEA5DD60FC7939C775535C018DFA24A3D9E9FFD7
- SPKI SHA-256: C77EA4F31F12D54786AD7AE5D1AB4BF5692E849EDD1CD06B50A3480A51C91523
- Validity: 2017-12-18 to 2032-12-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/FDFEFD8E9CF47E2D29D128616DA0DCA75076E3FE
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.7
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f5:88:9e:21:88:61:17:e2:55:d6:45:81:05:56:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Dec 18 06:29:55 2017 GMT
            Not After : Dec 18 06:29:55 2032 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign CH Qualified Platinum CA 2017 - G22 17-1, organizationIdentifier = NTRCH-CHE-109.357.012
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FD:FE:FD:8E:9C:F4:7E:2D:29:D1:28:61:6D:A0:DC:A7:50:76:E3:FE
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.1.7
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 78B08B7D449A53DEA551DBE9BEA5DD60FC7939C775535C018DFA24A3D9E9FFD7
    SPKI SHA256: C77EA4F31F12D54786AD7AE5D1AB4BF5692E849EDD1CD06B50A3480A51C91523
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.7
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign EV Gold CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign EV Gold CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 32C282C3A012007E
- SHA-256: FAFFC085FC87B2A5E3CD5AC9BD44B46A09234B119BA80E01659089F8E310044A
- SPKI SHA-256: 661CDEB8F249EE169086211BF2BBE1F065C857704685475D6B865EBD1122404B
- Validity: 2008-11-13 to 2023-11-13
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3657629624094031998 (0x32c282c3a012007e)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Nov 13 14:24:15 2008 GMT
            Not After : Nov 13 14:24:15 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign EV Gold CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:2D:D1:EC:66:43:10:04:C7:54:4B:2B:ED:12:6D:FF:9A:79:DD:51
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R4.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FAFFC085FC87B2A5E3CD5AC9BD44B46A09234B119BA80E01659089F8E310044A
    SPKI SHA256: 661CDEB8F249EE169086211BF2BBE1F065C857704685475D6B865EBD1122404B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign EV Gold CA 2009 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign EV Gold CA 2009 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: F792B7C4818C0458
- SHA-256: F9C26B91A186217860DC5AA1A69874947865AEC156D89FAC9B18660EA829C25E
- SPKI SHA-256: EBEE880A9CDE0968764DC41A808EC9833180143E87372E85F0FFE6100EFCED47
- Validity: 2009-06-10 to 2024-06-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f7:92:b7:c4:81:8c:04:58
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Jun 10 09:29:39 2009 GMT
            Not After : Jun  6 09:29:39 2024 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign EV Gold CA 2009 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                88:74:46:6D:C7:7C:B5:FA:72:71:19:DE:BF:27:5E:0D:68:E0:F7:27
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R4.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F9C26B91A186217860DC5AA1A69874947865AEC156D89FAC9B18660EA829C25E
    SPKI SHA256: EBEE880A9CDE0968764DC41A808EC9833180143E87372E85F0FFE6100EFCED47
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### SwissSign EV Gold CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign EV Gold CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 8108383CC00775C40C6D736BE3308B
- SHA-256: A434AAE4E15A5519E9B111FD08EC190FD2ADF13BBE30815C6E1606555CB31450
- SPKI SHA-256: 983291E69B69A7B3EA55479FC71D85B6AE729AC12ECC2120F8456B2CEAD0141F
- Validity: 2014-09-15 to 2035-03-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/EEFD46CAF7275E91BC5AB6E787CD0AFA550A2642
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://gold-ev-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:08:38:3c:c0:07:75:c4:0c:6d:73:6b:e3:30:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Sep 15 16:16:37 2014 GMT
            Not After : Mar  4 16:16:37 2035 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign EV Gold CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EE:FD:46:CA:F7:27:5E:91:BC:5A:B6:E7:87:CD:0A:FA:55:0A:26:42
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://gold-ev-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A434AAE4E15A5519E9B111FD08EC190FD2ADF13BBE30815C6E1606555CB31450
    SPKI SHA256: 983291E69B69A7B3EA55479FC71D85B6AE729AC12ECC2120F8456B2CEAD0141F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://gold-ev-g2.ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign LI Platinum Person CA 2017 - G22

- Subject: countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum Person CA 2017 - G22, organizationIdentifier=NTRL-FL-0002.523.017-8
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: AAEC07372B607A763535E76CEE3E42
- SHA-256: 8E35171DBC1351CF19E4D9911F367786A3B88C540529602CEF9C9EBA4EBAC33E
- SPKI SHA-256: A7237923EF7EE07140AF9618099C8678EED6BAFB66ED5FE70EDAFE530FB70E64
- Validity: 2017-06-27 to 2032-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            aa:ec:07:37:2b:60:7a:76:35:35:e7:6c:ee:3e:42
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jun 27 05:41:32 2017 GMT
            Not After : Jun 27 05:41:32 2032 GMT
        Subject: C = LI, O = SwissSign AG, CN = SwissSign LI Platinum Person CA 2017 - G22, organizationIdentifier = NTRL-FL-0002.523.017-8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                81:BA:FA:B4:51:57:F9:7C:97:E9:D4:DD:AC:7D:9D:5F:92:7B:3C:F9
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.7.1.2
                  CPS: http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8E35171DBC1351CF19E4D9911F367786A3B88C540529602CEF9C9EBA4EBAC33E
    SPKI SHA256: A7237923EF7EE07140AF9618099C8678EED6BAFB66ED5FE70EDAFE530FB70E64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign LI Platinum Person CA 2017 - G3

- Subject: countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum Person CA 2017 - G3, organizationIdentifier=NTRL-FL-0002.523.017-8
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum Root CA - G3
- Serial: F6E3176E90FFA85F0351025D3A102E
- SHA-256: D1B3E166D428C329218A8F5B613C77576C2AF702E3D99DB477DBACEE1BFD1B3A
- SPKI SHA-256: 6B21CA0A0ACCE8BDC0982DAFD9313DED85D371C8BC43B0EEEEA71649A9811DD1
- Validity: 2017-06-27 to 2032-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g3.ocsp.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
- CRL DP: http://crl.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28, ldap://directory.swisssign.net/CN=562A3F9058F4175A14B2D7081B855B546A541A28%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f6:e3:17:6e:90:ff:a8:5f:03:51:02:5d:3a:10:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum Root CA - G3
        Validity
            Not Before: Jun 27 05:47:24 2017 GMT
            Not After : Jun 27 05:47:24 2032 GMT
        Subject: C = LI, O = SwissSign AG, CN = SwissSign LI Platinum Person CA 2017 - G3, organizationIdentifier = NTRL-FL-0002.523.017-8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E3:3D:1E:BB:61:0D:AD:1D:68:10:FD:CE:8C:47:8C:D5:A3:27:4E:41
            X509v3 Authority Key Identifier:
                56:2A:3F:90:58:F4:17:5A:14:B2:D7:08:1B:85:5B:54:6A:54:1A:28
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=562A3F9058F4175A14B2D7081B855B546A541A28%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.7.1.2
                  CPS: http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/562A3F9058F4175A14B2D7081B855B546A541A28
                OCSP - URI:http://platinum-g3.ocsp.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D1B3E166D428C329218A8F5B613C77576C2AF702E3D99DB477DBACEE1BFD1B3A
    SPKI SHA256: 6B21CA0A0ACCE8BDC0982DAFD9313DED85D371C8BC43B0EEEEA71649A9811DD1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- AIA OCSP: http://platinum-g3.ocsp.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/562A3F9058F4175A14B2D7081B855B546A541A28
- CRL Distribution Points: http://crl.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28, ldap://directory.swisssign.net/CN=562A3F9058F4175A14B2D7081B855B546A541A28%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign LI Platinum Server CA 2017 - G22

- Subject: countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum Server CA 2017 - G22, organizationIdentifier=NTRL-FL-0002.523.017-8
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 9A6FF1F0082CEB182521454362AD3E
- SHA-256: A2F021CFE19A1C56986F0DFA6398F1A0FCC1B6504E47E0AD7FCBE5330E04AA2F
- SPKI SHA-256: 0EBD6B0B9A8FE009CA5D0D7A3152DF03680BB82173BBD15330C8FD6FCE3F0ADA
- Validity: 2017-06-27 to 2032-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9a:6f:f1:f0:08:2c:eb:18:25:21:45:43:62:ad:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jun 27 05:39:24 2017 GMT
            Not After : Jun 27 05:39:24 2032 GMT
        Subject: C = LI, O = SwissSign AG, CN = SwissSign LI Platinum Server CA 2017 - G22, organizationIdentifier = NTRL-FL-0002.523.017-8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                47:70:27:7F:A7:A8:6A:25:4D:C7:88:68:5F:10:32:C0:01:2F:6B:D8
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.7.1.2
                  CPS: http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A2F021CFE19A1C56986F0DFA6398F1A0FCC1B6504E47E0AD7FCBE5330E04AA2F
    SPKI SHA256: 0EBD6B0B9A8FE009CA5D0D7A3152DF03680BB82173BBD15330C8FD6FCE3F0ADA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign LI Platinum TSA CA 2017 - G3

- Subject: countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Platinum TSA CA 2017 - G3, organizationIdentifier=NTRL-FL-0002.523.017-8
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum Root CA - G3
- Serial: 80C7928FA7A6D0F4977D2D963AE84C
- SHA-256: FDA6049B266153B9C843662A77C50D2F0A06B8CDC8111666378BB118E7215ACE
- SPKI SHA-256: 0DED6C458D474D287CED7CAA46BC2255796EFA644BEA7C6C6D6B5558520D9DC6
- Validity: 2017-06-27 to 2032-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g3.ocsp.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
- CRL DP: http://crl.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28, ldap://directory.swisssign.net/CN=562A3F9058F4175A14B2D7081B855B546A541A28%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:c7:92:8f:a7:a6:d0:f4:97:7d:2d:96:3a:e8:4c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum Root CA - G3
        Validity
            Not Before: Jun 27 05:45:18 2017 GMT
            Not After : Jun 27 05:45:18 2032 GMT
        Subject: C = LI, O = SwissSign AG, CN = SwissSign LI Platinum TSA CA 2017 - G3, organizationIdentifier = NTRL-FL-0002.523.017-8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                58:39:92:44:F9:BE:12:C7:98:76:10:66:C8:FF:95:70:2C:2F:9F:EE
            X509v3 Authority Key Identifier:
                56:2A:3F:90:58:F4:17:5A:14:B2:D7:08:1B:85:5B:54:6A:54:1A:28
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=562A3F9058F4175A14B2D7081B855B546A541A28%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.7.1.2
                  CPS: http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/562A3F9058F4175A14B2D7081B855B546A541A28
                OCSP - URI:http://platinum-g3.ocsp.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: FDA6049B266153B9C843662A77C50D2F0A06B8CDC8111666378BB118E7215ACE
    SPKI SHA256: 0DED6C458D474D287CED7CAA46BC2255796EFA644BEA7C6C6D6B5558520D9DC6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- AIA OCSP: http://platinum-g3.ocsp.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/562A3F9058F4175A14B2D7081B855B546A541A28
- CRL Distribution Points: http://crl.swisssign.net/562A3F9058F4175A14B2D7081B855B546A541A28, ldap://directory.swisssign.net/CN=562A3F9058F4175A14B2D7081B855B546A541A28%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign LI Qualified Platinum CA 2016 - G22

- Subject: countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI Qualified Platinum CA 2016 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 4945260CBF0F20167412421F095E8D
- SHA-256: B5A00D9582756C4FACC34CC64DF1B59703EBCEA346A44A54907B6BD6D214D28A
- SPKI SHA-256: 57CE76F6BC2501C12AC8EAC694B1FA2FFB67CB75F1D8A709FE3EAEDE54DA0A15
- Validity: 2016-06-15 to 2036-10-25
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:45:26:0c:bf:0f:20:16:74:12:42:1f:09:5e:8d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jun 15 08:04:15 2016 GMT
            Not After : Oct 25 08:36:00 2036 GMT
        Subject: C = LI, O = SwissSign AG, CN = SwissSign LI Qualified Platinum CA 2016 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:22:25:E8:52:97:60:24:3E:6E:63:7E:5C:61:F2:1C:81:BF:C7:9E
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.7.1
                  CPS: http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
                  User Notice:
                    Explicit Text: This is a certification authority that issues qualified certificates according to Lichtenstein digital signature law.
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B5A00D9582756C4FACC34CC64DF1B59703EBCEA346A44A54907B6BD6D214D28A
    SPKI SHA256: 57CE76F6BC2501C12AC8EAC694B1FA2FFB67CB75F1D8A709FE3EAEDE54DA0A15
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_cert_policy_explicit_text_not_utf8: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign LI TSA Platinum CA 2017 - G22

- Subject: countryName=LI, organizationName=SwissSign AG, commonName=SwissSign LI TSA Platinum CA 2017 - G22, organizationIdentifier=NTRL-FL-0002.523.017-8
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 0BCA8DB4E2DF4497F5219B816B9618
- SHA-256: 988BA0B6EB48CB076060BCDA65EF2C3022788DAFA37948341C67D15FB17F8AE7
- SPKI SHA-256: 0B01083D1823F624F1BA799F5079CB5659F897FA48B13A9A524F93EF552DDA98
- Validity: 2017-06-27 to 2032-06-27
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:ca:8d:b4:e2:df:44:97:f5:21:9b:81:6b:96:18
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jun 27 05:36:14 2017 GMT
            Not After : Jun 27 05:36:14 2032 GMT
        Subject: C = LI, O = SwissSign AG, CN = SwissSign LI TSA Platinum CA 2017 - G22, organizationIdentifier = NTRL-FL-0002.523.017-8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                16:B4:0C:4E:A5:78:FA:C0:4A:B0:22:E5:07:FE:D3:1C:C5:4E:53:B6
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.7.1.2
                  CPS: http://repository.swisssign.com/SwissSign-LI-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 988BA0B6EB48CB076060BCDA65EF2C3022788DAFA37948341C67D15FB17F8AE7
    SPKI SHA256: 0B01083D1823F624F1BA799F5079CB5659F897FA48B13A9A524F93EF552DDA98
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.7.1.2
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Personal Gold CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Gold CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 392B241D6144C35A
- SHA-256: 2B65E45EA181C1CC21B1CC9E9FB1E10F54129432BB78973F608C66A4151FBF0E
- SPKI SHA-256: 1FCC2F7ECD7FF542AA9C4A9F5AB45D72376E95551E5B14A1846F8A63912D7400
- Validity: 2008-07-07 to 2023-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/AE7A8B15F8253EF41AEF436B25C0A6E11A3CA6AB
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4119425992764998490 (0x392b241d6144c35a)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Jul  7 17:24:18 2008 GMT
            Not After : Jul  7 17:24:18 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Gold CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AE:7A:8B:15:F8:25:3E:F4:1A:EF:43:6B:25:C0:A6:E1:1A:3C:A6:AB
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.3
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2B65E45EA181C1CC21B1CC9E9FB1E10F54129432BB78973F608C66A4151FBF0E
    SPKI SHA256: 1FCC2F7ECD7FF542AA9C4A9F5AB45D72376E95551E5B14A1846F8A63912D7400
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Personal Gold CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Gold CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 191795DC22741B121DDB544C5CCBDC
- SHA-256: 77D6C2AF5A7B86F63D9918C87533779F2AF08D35CFA14DA4938C803F53DE18A1
- SPKI SHA-256: 979918F9ADBEA82346327ECB5DBFE518410D17E75938B71C40E6412ABE34C151
- Validity: 2014-09-19 to 2029-09-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/DA32F949F851CC9871660CD9CEB6DB923F094BEF
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:17:95:dc:22:74:1b:12:1d:db:54:4c:5c:cb:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Sep 19 14:10:25 2014 GMT
            Not After : Sep 15 14:10:25 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Gold CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:32:F9:49:F8:51:CC:98:71:66:0C:D9:CE:B6:DB:92:3F:09:4B:EF
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.6
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 77D6C2AF5A7B86F63D9918C87533779F2AF08D35CFA14DA4938C803F53DE18A1
    SPKI SHA256: 979918F9ADBEA82346327ECB5DBFE518410D17E75938B71C40E6412ABE34C151
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.6
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Personal Gold CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Gold CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: AF2D6F490B33B573CA699626C7C3DC
- SHA-256: 6A1190BBB7CF20FA9331D2FD385444FCD027181F0E488D5EDA5C67EC567A0392
- SPKI SHA-256: DE0F1794384B44F5C2FE3A944AE7D70B45AC6AF9B89F32EA9456D984683C6DAF
- Validity: 2014-09-15 to 2029-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            af:2d:6f:49:0b:33:b5:73:ca:69:96:26:c7:c3:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Sep 15 16:14:03 2014 GMT
            Not After : Sep 11 16:14:03 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Gold CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DF:71:4C:4B:4A:79:0A:46:E3:16:6A:AD:C6:87:B9:50:81:4B:34:64
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.4
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6A1190BBB7CF20FA9331D2FD385444FCD027181F0E488D5EDA5C67EC567A0392
    SPKI SHA256: DE0F1794384B44F5C2FE3A944AE7D70B45AC6AF9B89F32EA9456D984683C6DAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.4
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Personal Platinum CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Platinum CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 91C4EC3C7C7D6055
- SHA-256: 19BCAC8138C5DDB8AA872D7E1F1027D0846AEFC451EAD22E30783ECFCDE89FB7
- SPKI SHA-256: 1C7118C70A7424DDA3621B456234EAA75386B9FDACD50C3600E7561711621798
- Validity: 2008-07-07 to 2023-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.3.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            91:c4:ec:3c:7c:7d:60:55
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jul  7 16:51:19 2008 GMT
            Not After : Jul  7 16:51:19 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Platinum CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                94:BF:CF:77:F8:3B:EA:26:38:E5:71:1C:A7:11:EF:C1:E0:2F:D9:1F
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.3.2
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-Personal-CP-CPS-R2.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 19BCAC8138C5DDB8AA872D7E1F1027D0846AEFC451EAD22E30783ECFCDE89FB7
    SPKI SHA256: 1C7118C70A7424DDA3621B456234EAA75386B9FDACD50C3600E7561711621798
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.3.2
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Personal Platinum CA 2010 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Platinum CA 2010 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: A6404397011367567BCA96067A54ED
- SHA-256: 275F8A75C02DECAC9DCC945C30C7F370EDF4E739B0CEA75652897B16D2BD75D7
- SPKI SHA-256: 25608F535388CBB3D149B95FC9A4D638C7E53E54CC5713876F52A33C8063BFFE
- Validity: 2010-07-05 to 2025-07-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/4AD43B86EF10538EAFE44C77594782FD00117688
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a6:40:43:97:01:13:67:56:7b:ca:96:06:7a:54:ed
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jul  5 12:13:35 2010 GMT
            Not After : Jul  1 12:13:35 2025 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Platinum CA 2010 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                4A:D4:3B:86:EF:10:53:8E:AF:E4:4C:77:59:47:82:FD:00:11:76:88
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 275F8A75C02DECAC9DCC945C30C7F370EDF4E739B0CEA75652897B16D2BD75D7
    SPKI SHA256: 25608F535388CBB3D149B95FC9A4D638C7E53E54CC5713876F52A33C8063BFFE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Personal Platinum CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Platinum CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: C79B9900921A423AB1D15B5DF721A4
- SHA-256: 7C9CCF1733FD36AC3E3A9B179AB0C755FBB1421EB803596355C2ED5D03CD2765
- SPKI SHA-256: 2BAD9B35FC7CA5AE10A91F37B544D905087E25C046EE0A4DE3346CDDE65E1DB8
- Validity: 2014-09-15 to 2029-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/59B0D9BF3DC137B6DC0614A7E199E34218DA9641
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c7:9b:99:00:92:1a:42:3a:b1:d1:5b:5d:f7:21:a4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Sep 15 16:21:16 2014 GMT
            Not After : Sep 11 16:21:16 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Platinum CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                59:B0:D9:BF:3D:C1:37:B6:DC:06:14:A7:E1:99:E3:42:18:DA:96:41
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7C9CCF1733FD36AC3E3A9B179AB0C755FBB1421EB803596355C2ED5D03CD2765
    SPKI SHA256: 2BAD9B35FC7CA5AE10A91F37B544D905087E25C046EE0A4DE3346CDDE65E1DB8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Personal Silver CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Silver CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: E256B753976B7658
- SHA-256: FA397DE8DB6F110A7FA34D101BAC8A914750F53B0223A8BD2FB812E757155C20
- SPKI SHA-256: 8F28554F996508147BFB1C06A2AD9294A41C31AB161EA9A8BB14D850ED45862C
- Validity: 2008-07-09 to 2023-07-09
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/EB35B1566D156058F4E122CD1C461CAED0040065
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e2:56:b7:53:97:6b:76:58
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Jul  9 11:11:09 2008 GMT
            Not After : Jul  9 11:11:09 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Silver CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                EB:35:B1:56:6D:15:60:58:F4:E1:22:CD:1C:46:1C:AE:D0:04:00:65
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.3
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FA397DE8DB6F110A7FA34D101BAC8A914750F53B0223A8BD2FB812E757155C20
    SPKI SHA256: 8F28554F996508147BFB1C06A2AD9294A41C31AB161EA9A8BB14D850ED45862C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Personal Silver CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Silver CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 4FC59A00D114D28F931895212E0DAB
- SHA-256: 042C80330DDBC2FC09DDF49C93B89F0F16F81A2C13C736B1D37CA3F031FEECAA
- SPKI SHA-256: 83497225AC719A943B03DF16616703C3C65E0D19874C8EEDBF1D73FB4FB5767C
- Validity: 2014-09-15 to 2029-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:c5:9a:00:d1:14:d2:8f:93:18:95:21:2e:0d:ab
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 15 15:02:02 2014 GMT
            Not After : Sep 11 15:02:02 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Silver CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B5:9E:86:9C:FF:F3:C3:BC:D7:79:B3:AE:46:7E:23:25:32:FC:3D:DD
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.4
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                OCSP - URI:http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 042C80330DDBC2FC09DDF49C93B89F0F16F81A2C13C736B1D37CA3F031FEECAA
    SPKI SHA256: 83497225AC719A943B03DF16616703C3C65E0D19874C8EEDBF1D73FB4FB5767C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.4
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Personal Silver CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Personal Silver CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 0544D64EAD1ED336D532405D00B936
- SHA-256: C9E40F4E83396F34A7C861817B4EDAB3DC1F8BAC699FD50CB261FA9123D55EF4
- SPKI SHA-256: 9B4333DD755AA61E0318DF947DC555EE2F370ED482C16D1EBF1C03BD97FF8F5F
- Validity: 2014-09-19 to 2029-09-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SwissSign AG
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/F0C7A33291B5EBCAB5587715A74EBE1A5D614325
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:44:d6:4e:ad:1e:d3:36:d5:32:40:5d:00:b9:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 19 20:36:49 2014 GMT
            Not After : Sep 15 20:36:49 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Personal Silver CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:C7:A3:32:91:B5:EB:CA:B5:58:77:15:A7:4E:BE:1A:5D:61:43:25
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.6
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                OCSP - URI:http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C9E40F4E83396F34A7C861817B4EDAB3DC1F8BAC699FD50CB261FA9123D55EF4
    SPKI SHA256: 9B4333DD755AA61E0318DF947DC555EE2F370ED482C16D1EBF1C03BD97FF8F5F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.6
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign PSS Qualified Platinum CA 2013 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign PSS Qualified Platinum CA 2013 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: BF274B8EB1E48A2717865DD851095D
- SHA-256: A63626B494AC3F6BB59C9A5103307AE36D0D5CA6E0CBB6E3C4FB95D08CFAC5F2
- SPKI SHA-256: 957FDE5FA00A06505C71BA53BA6EE19BC5530BA6C2A0F8D3ECE82B4E7C9BB845
- Validity: 2013-12-09 to 2028-12-05
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bf:27:4b:8e:b1:e4:8a:27:17:86:5d:d8:51:09:5d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Dec  9 08:52:36 2013 GMT
            Not After : Dec  5 08:52:36 2028 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign PSS Qualified Platinum CA 2013 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Issuer Alternative Name:
                DirName:/C=CH/O=ZertES Recognition Body: KPMG AG
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E6:F3:E3:83:3D:CA:47:F0:2F:E1:26:F0:D5:2D:03:71:62:A5:05:88
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS-R3.pdf
                  User Notice:
                    Explicit Text: This is a certification authority that issues qualified certificates according to Swiss digital signature law.
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A63626B494AC3F6BB59C9A5103307AE36D0D5CA6E0CBB6E3C4FB95D08CFAC5F2
    SPKI SHA256: 957FDE5FA00A06505C71BA53BA6EE19BC5530BA6C2A0F8D3ECE82B4E7C9BB845
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_cert_policy_explicit_text_not_utf8: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign Qualified Platinum CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 243E113B43A8968B
- SHA-256: A493C587F71E886A03AD1D5D613671DFDA07DBD8908E291E19514E5522249B49
- SPKI SHA-256: A5F50DA6468070B925D874806DDF029B9C87EE25A56B4613A3C9E6FF91B09620
- Validity: 2008-07-07 to 2023-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2611543780157331083 (0x243e113b43a8968b)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jul  7 16:59:30 2008 GMT
            Not After : Jul  7 16:59:30 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Qualified Platinum CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Issuer Alternative Name:
                DirName:/C=CH/O=ZertES Recognition Body: KPMG Klynveld Peat Marwick Goerdeler SA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3B:6C:11:8A:3C:B3:8A:52:B8:6A:C1:1D:CE:CD:EB:AA:DC:8D:C1:33
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.2.2
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-Qualified-CP-CPS-R2.pdf
                  User Notice:
                    Explicit Text: This is a certification authority that issues qualified certificates according to Swiss digital signature law.
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0
0......F..
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A493C587F71E886A03AD1D5D613671DFDA07DBD8908E291E19514E5522249B49
    SPKI SHA256: A5F50DA6468070B925D874806DDF029B9C87EE25A56B4613A3C9E6FF91B09620
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.2.2
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Qualified Platinum CA 2010 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA 2010 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 84CFA94CCA66FE1E2C22385A300027
- SHA-256: 4C11A251302077E46A74B2A57464B68F3ABF049586C9A68DDF4E9E503F236AB0
- SPKI SHA-256: 8997789A16A491B8002D7C8BFDF42EE0B54E0DF3288C73F4A2B32B8F2C6B337C
- Validity: 2010-01-27 to 2025-01-23
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:cf:a9:4c:ca:66:fe:1e:2c:22:38:5a:30:00:27
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Jan 27 15:28:34 2010 GMT
            Not After : Jan 23 15:28:34 2025 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Qualified Platinum CA 2010 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Issuer Alternative Name:
                DirName:/C=CH/O=ZertES Recognition Body: KPMG AG
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                0F:EA:92:FF:66:E5:CE:9D:E6:44:82:06:03:BA:7A:FC:36:2A:2C:EE
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.1.1.1.3
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS-R3.pdf
                  User Notice:
                    Explicit Text: This is a certification authority that issues qualified certificates according to Swiss digital signature law.
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4C11A251302077E46A74B2A57464B68F3ABF049586C9A68DDF4E9E503F236AB0
    SPKI SHA256: 8997789A16A491B8002D7C8BFDF42EE0B54E0DF3288C73F4A2B32B8F2C6B337C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.1.1.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Qualified Platinum CA 2010 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA 2010 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: AB32CDBC9B59942304FA6D84E40DBD
- SHA-256: B0B05D7131D7881F78BA4172B442B7D774D04FF27D383BE3E459A372473B1E15
- SPKI SHA-256: BAB6E1C24809CF368C0A77D85BB21D792329C3253C402E9386FF904BCFF869AE
- Validity: 2010-04-06 to 2025-04-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/7251E0AA9DFB7E3844EA026F40C89FCE28BF1C77
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ab:32:cd:bc:9b:59:94:23:04:fa:6d:84:e4:0d:bd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Apr  6 14:03:34 2010 GMT
            Not After : Apr  2 14:03:34 2025 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Qualified Platinum CA 2010 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Issuer Alternative Name:
                DirName:/C=CH/O=ZertES Recognition Body: KPMG AG
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                72:51:E0:AA:9D:FB:7E:38:44:EA:02:6F:40:C8:9F:CE:28:BF:1C:77
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS-R3.pdf
                  User Notice:
                    Explicit Text: This is a certification authority that issues qualified certificates according to Swiss digital signature law.
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B0B05D7131D7881F78BA4172B442B7D774D04FF27D383BE3E459A372473B1E15
    SPKI SHA256: BAB6E1C24809CF368C0A77D85BB21D792329C3253C402E9386FF904BCFF869AE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Qualified Platinum CA G22 16-1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Qualified Platinum CA G22 16-1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: 5B2400364E9D95F3E870118ABD7D09
- SHA-256: 0FAC8B71A8C979B861322C4B2AF21AE12A5196525AC2F079BD9268D816D2B6FC
- SPKI SHA-256: 7D0C78A40DA3A8C52709AECC3DB703F371D556700328BB870F0E9EBC1D37D3F1
- Validity: 2016-09-13 to 2031-09-10
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/5D33F251319BE38AD058EBB7A9D28B4B14015F04
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:24:00:36:4e:9d:95:f3:e8:70:11:8a:bd:7d:09
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Sep 13 08:51:42 2016 GMT
            Not After : Sep 10 08:51:42 2031 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Qualified Platinum CA G22 16-1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Issuer Alternative Name:
                DirName:/C=CH/O=ZertES Recognition Body: KPMG AG
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                5D:33:F2:51:31:9B:E3:8A:D0:58:EB:B7:A9:D2:8B:4B:14:01:5F:04
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
                  User Notice:
                    Explicit Text: This is a certification authority that issues qualified certificates according to Swiss digital signature law.
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
            qcStatements:
                0.0......F..0......F..
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0FAC8B71A8C979B861322C4B2AF21AE12A5196525AC2F079BD9268D816D2B6FC
    SPKI SHA256: 7D0C78A40DA3A8C52709AECC3DB703F371D556700328BB870F0E9EBC1D37D3F1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://platinum-g2.ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_ext_cert_policy_explicit_text_not_utf8: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign RSA SMIME LCP 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME LCP 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Serial: 9595B80E0EA5AF93E23D8017CEF6C0
- SHA-256: 8F5DB76CBEE38EAADF8D74BFC179E304821A54826EDFB8EDBD08FC680A4BCFCC
- SPKI SHA-256: 36A1372923E7C853C3E5619DDC24A7089281EC07EF6E4B2A8EDF62C366B31826
- Validity: 2021-08-03 to 2036-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.swisssign.com/SwissSign_CP_LCP.pdf, https://repository.swisssign.com/SwissSign_CPS_SMIME.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.16.756.1.89.2.1.11, 0.4.0.2042.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            95:95:b8:0e:0e:a5:af:93:e2:3d:80:17:ce:f6:c0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Validity
            Not Before: Aug  3 19:05:16 2021 GMT
            Not After : Jul 30 19:05:16 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME LCP 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                CD:E0:AA:90:E5:EE:D0:58:37:21:D6:15:59:1D:80:03:25:DF:8F:61
            X509v3 Authority Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.11
                Policy: 0.4.0.2042.1.3
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8F5DB76CBEE38EAADF8D74BFC179E304821A54826EDFB8EDBD08FC680A4BCFCC
    SPKI SHA256: 36A1372923E7C853C3E5619DDC24A7089281EC07EF6E4B2A8EDF62C366B31826
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.16.756.1.89.2.1.11, 0.4.0.2042.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
- CRL Distribution Points: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME LCP ICA 2021 - 2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME LCP ICA 2021 - 2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Serial: 2C5AA9D954FDB2AB96AD17B65F8CF4
- SHA-256: 5CFFA8DB135F913363ACEB7CE362D098F3C1EBD26C63C560C095381E896504FA
- SPKI SHA-256: DE9E9B2708077A0280AF10F6C0B9054FDA769D3AEE8D079B5BF3545D3FC99B35
- Validity: 2021-08-04 to 2036-07-31
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/FA54C082A6FE96BD04C75F9F5F820C3DC3954F47
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.16.756.1.89.2.1.11, 0.4.0.2042.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:5a:a9:d9:54:fd:b2:ab:96:ad:17:b6:5f:8c:f4
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Validity
            Not Before: Aug  4 12:12:59 2021 GMT
            Not After : Jul 31 12:12:59 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME LCP ICA 2021 - 2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                FA:54:C0:82:A6:FE:96:BD:04:C7:5F:9F:5F:82:0C:3D:C3:95:4F:47
            X509v3 Authority Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.11
                Policy: 0.4.0.2042.1.3
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5CFFA8DB135F913363ACEB7CE362D098F3C1EBD26C63C560C095381E896504FA
    SPKI SHA256: DE9E9B2708077A0280AF10F6C0B9054FDA769D3AEE8D079B5BF3545D3FC99B35
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.16.756.1.89.2.1.11, 0.4.0.2042.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
- CRL Distribution Points: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME LCP ICA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME LCP ICA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 5530D33DD130D46B1E9D76E8DA0C0A128C6E7F76
- SHA-256: D7F41FABE5A459BAC6882465C75CCFF2BAA52487AABC34706CAF2A18AC53A5C2
- SPKI SHA-256: 7A32F57C998C46BB01BA1C73DA96F4E297AE5DD03ADBEE2DF57C091202C876A9
- Validity: 2022-06-29 to 2036-06-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-d5057ba0-ce09-4d1d-8cc9-0a60fa4c49c0
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 0.4.0.2042.1.3, 2.16.756.1.89.2.1.11
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:30:d3:3d:d1:30:d4:6b:1e:9d:76:e8:da:0c:0a:12:8c:6e:7f:76
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: Jun 29 09:10:52 2022 GMT
            Not After : Jun 29 09:10:52 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME LCP ICA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.3
                Policy: 2.16.756.1.89.2.1.11
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                0B:83:D4:72:20:86:CC:E1:3A:EF:99:B6:77:CD:51:A6:A3:72:8F:5C
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D7F41FABE5A459BAC6882465C75CCFF2BAA52487AABC34706CAF2A18AC53A5C2
    SPKI SHA256: 7A32F57C998C46BB01BA1C73DA96F4E297AE5DD03ADBEE2DF57C091202C876A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 0.4.0.2042.1.3, 2.16.756.1.89.2.1.11
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME MV ICA 2024 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME MV ICA 2024 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 3EC79E13DA89FA849D6E7CB92EF1074E9CD40802
- SHA-256: E3367FE0597156205E947903D226C30329951CEE3E63E01FD414F00F85804667
- SPKI SHA-256: 314EE37C1B9DEA3B5C5B27A5134F72F3F46F178F9E1B35C757FA240F4EA3210A
- Validity: 2024-05-28 to 2036-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-e97f07c4-e634-4cec-8e2a-04b20a7a30c5
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 0.4.0.2042.1.3, 2.16.756.1.89.2.1.11
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:c7:9e:13:da:89:fa:84:9d:6e:7c:b9:2e:f1:07:4e:9c:d4:08:02
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: May 28 08:41:10 2024 GMT
            Not After : May 28 08:41:10 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME MV ICA 2024 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
                Policy: 0.4.0.2042.1.3
                Policy: 2.16.756.1.89.2.1.11
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                BF:B4:16:41:A2:A7:9F:D7:4D:85:01:0A:A1:5C:BE:DB:C5:D2:E5:94
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E3367FE0597156205E947903D226C30329951CEE3E63E01FD414F00F85804667
    SPKI SHA256: 314EE37C1B9DEA3B5C5B27A5134F72F3F46F178F9E1B35C757FA240F4EA3210A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.1, 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 0.4.0.2042.1.3, 2.16.756.1.89.2.1.11
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME NCP extended ICA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP extended ICA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Serial: 45738B321942F875317A4806EB0A95
- SHA-256: 0A6EEB87C2B4AC4A0DF4A68CA7E5244408E06A0CF3BE973156A52AAD835D7466
- SPKI SHA-256: 89A9D90D72549AAB1845DA37D5905E19DABCE0C7DC3691F2107FD61030EB8846
- Validity: 2021-08-03 to 2036-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/2B661A63041903A719FC35E7C3B8D1368F4E9A41
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 2.16.756.1.89.2.1.13, 0.4.0.2042.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:73:8b:32:19:42:f8:75:31:7a:48:06:eb:0a:95
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Validity
            Not Before: Aug  3 19:16:28 2021 GMT
            Not After : Jul 30 19:16:28 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME NCP extended ICA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                2B:66:1A:63:04:19:03:A7:19:FC:35:E7:C3:B8:D1:36:8F:4E:9A:41
            X509v3 Authority Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.13
                Policy: 0.4.0.2042.1.1
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0A6EEB87C2B4AC4A0DF4A68CA7E5244408E06A0CF3BE973156A52AAD835D7466
    SPKI SHA256: 89A9D90D72549AAB1845DA37D5905E19DABCE0C7DC3691F2107FD61030EB8846
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 2.16.756.1.89.2.1.13, 0.4.0.2042.1.1
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
- CRL Distribution Points: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME NCP extended ICA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP extended ICA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 4653D903D9AE555F0BB20F3EC8B2B50D83D7CA34
- SHA-256: 7196E86DCFDB92B0509213D806DCA2465FC41415A0B4069D35F946DE6813CF79
- SPKI SHA-256: 329C47C8987215AF2C00E8BAFE1B34C041668EA9FC031F384133155FD502C691
- Validity: 2022-06-29 to 2036-06-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-26ab0cd6-f539-4f93-be04-39250cd56682
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 0.4.0.2042.1.1, 2.16.756.1.89.2.1.13
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:53:d9:03:d9:ae:55:5f:0b:b2:0f:3e:c8:b2:b5:0d:83:d7:ca:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: Jun 29 09:21:13 2022 GMT
            Not After : Jun 29 09:21:13 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME NCP extended ICA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.1
                Policy: 2.16.756.1.89.2.1.13
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                56:A2:DF:F3:E1:84:1D:1B:A0:FF:7F:3F:F0:71:18:85:28:F8:3D:CD
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7196E86DCFDB92B0509213D806DCA2465FC41415A0B4069D35F946DE6813CF79
    SPKI SHA256: 329C47C8987215AF2C00E8BAFE1B34C041668EA9FC031F384133155FD502C691
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System, Microsoft Smartcard Login
- Certificate Policies: 0.4.0.2042.1.1, 2.16.756.1.89.2.1.13
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME NCP ICA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP ICA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Serial: 68D130DD08874B1E60622EA5E26304
- SHA-256: 1935AA544A73D755E913357FCE0E44AFC90E0809AC97A89964F0A90A59C376B6
- SPKI SHA-256: 4BBE0C54FADC3B6FAACD7581D1EC696742A38F88CE551F6E9FD9855DC010C057
- Validity: 2021-08-03 to 2036-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/E1644D6ECA9EC75DC97ECD4FDC3B53F45D0F18D3
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.16.756.1.89.2.1.12, 0.4.0.2042.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:d1:30:dd:08:87:4b:1e:60:62:2e:a5:e2:63:04
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Validity
            Not Before: Aug  3 19:09:30 2021 GMT
            Not After : Jul 30 19:09:30 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME NCP ICA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E1:64:4D:6E:CA:9E:C7:5D:C9:7E:CD:4F:DC:3B:53:F4:5D:0F:18:D3
            X509v3 Authority Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.12
                Policy: 0.4.0.2042.1.1
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1935AA544A73D755E913357FCE0E44AFC90E0809AC97A89964F0A90A59C376B6
    SPKI SHA256: 4BBE0C54FADC3B6FAACD7581D1EC696742A38F88CE551F6E9FD9855DC010C057
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.16.756.1.89.2.1.12, 0.4.0.2042.1.1
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
- CRL Distribution Points: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80, ldap://directory.swisssign.net/CN=090CBF2AA21D04240CB2F9400A41C2CF5A72AA80%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME NCP ICA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME NCP ICA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 796C0FD9724F3291C0083A1A6DEEC2670EB6DCA0
- SHA-256: 99A56DD8DACA399FCA2E3834ED75760E96C133564062F8B530B355BED99A409D
- SPKI SHA-256: 4BA21A72170F988AF584286E1E7EEB615623ADA9CDF0582EAF0F0156500F887F
- Validity: 2022-06-29 to 2036-06-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-5639ce88-5da9-408f-b25d-685d1e3e020a
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 0.4.0.2042.1.1, 2.16.756.1.89.2.1.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:6c:0f:d9:72:4f:32:91:c0:08:3a:1a:6d:ee:c2:67:0e:b6:dc:a0
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: Jun 29 09:17:39 2022 GMT
            Not After : Jun 29 09:17:39 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME NCP ICA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 0.4.0.2042.1.1
                Policy: 2.16.756.1.89.2.1.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                E4:BE:C7:60:A7:82:A3:18:E8:64:FC:E2:16:53:05:87:D4:6A:E9:8E
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 99A56DD8DACA399FCA2E3834ED75760E96C133564062F8B530B355BED99A409D
    SPKI SHA256: 4BA21A72170F988AF584286E1E7EEB615623ADA9CDF0582EAF0F0156500F887F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 0.4.0.2042.1.1, 2.16.756.1.89.2.1.12
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME OV ICA 2024 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME OV ICA 2024 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 4CC55A537AE82BA4C4240767584DDA63D6844E1B
- SHA-256: 1F11D479C62DE8DAA554E28674DC58C00BDC0401C175E23689E8BE95DFD687BF
- SPKI SHA-256: 710181B5A6A15F856BAF6400A1CB6482C25336F98B0E1AB44718EDD60E23D651
- Validity: 2024-05-28 to 2036-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-0821da85-47ea-48d1-8064-601ee819ac8f
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 0.4.0.2042.1.1, 2.16.756.1.89.2.1.14
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:c5:5a:53:7a:e8:2b:a4:c4:24:07:67:58:4d:da:63:d6:84:4e:1b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: May 28 08:56:49 2024 GMT
            Not After : May 28 08:56:49 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME OV ICA 2024 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.2.1
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 0.4.0.2042.1.1
                Policy: 2.16.756.1.89.2.1.14
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                29:80:EF:B1:2A:F1:37:52:AB:49:7C:78:FB:81:F3:8A:EE:27:C7:C7
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1F11D479C62DE8DAA554E28674DC58C00BDC0401C175E23689E8BE95DFD687BF
    SPKI SHA256: 710181B5A6A15F856BAF6400A1CB6482C25336F98B0E1AB44718EDD60E23D651
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.2.1, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 0.4.0.2042.1.1, 2.16.756.1.89.2.1.14
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME Root CA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: DE4C5520F6DCF4021B0F1154F78D10
- SHA-256: BC8BBD7D279D2E5F070BCEF6FAF3AAB1BEF30DA3EB2875424295AD147F2AEF07
- SPKI SHA-256: 1CAA511C32E887C7F6AC41445B28C0D197A8A4A4DBB38CD5F3B5DEB2CF870F85
- Validity: 2021-08-03 to 2036-10-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            de:4c:55:20:f6:dc:f4:02:1b:0f:11:54:f7:8d:10
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Aug  3 13:14:55 2021 GMT
            Not After : Oct 23 13:14:55 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BC8BBD7D279D2E5F070BCEF6FAF3AAB1BEF30DA3EB2875424295AD147F2AEF07
    SPKI SHA256: 1CAA511C32E887C7F6AC41445B28C0D197A8A4A4DBB38CD5F3B5DEB2CF870F85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_sub_ca_certificate_policies_missing: 
- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [current] warn w_sub_ca_aia_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### SwissSign RSA SMIME Root CA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2021 - 1
- Serial: 746CD5D1943C167DAEBE03EDE56E07
- SHA-256: B6D56F3DD26AC844E57C8BFE9054F57061350A90894B99CD9811E9A545FC84C5
- SPKI SHA-256: 1CAA511C32E887C7F6AC41445B28C0D197A8A4A4DBB38CD5F3B5DEB2CF870F85
- Validity: 2021-08-02 to 2046-07-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/090CBF2AA21D04240CB2F9400A41C2CF5A72AA80
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            74:6c:d5:d1:94:3c:16:7d:ae:be:03:ed:e5:6e:07
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Validity
            Not Before: Aug  2 11:20:08 2021 GMT
            Not After : Jul 27 11:20:08 2046 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
            X509v3 Authority Key Identifier:
                09:0C:BF:2A:A2:1D:04:24:0C:B2:F9:40:0A:41:C2:CF:5A:72:AA:80
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B6D56F3DD26AC844E57C8BFE9054F57061350A90894B99CD9811E9A545FC84C5
    SPKI SHA256: 1CAA511C32E887C7F6AC41445B28C0D197A8A4A4DBB38CD5F3B5DEB2CF870F85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### SwissSign RSA SMIME Root CA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 460ED4017190A01A832C4A42102815D2611BAD32
- SHA-256: 9A12C392BFE57891A0C545309D4D9FD567E480CB613D6342278B195C79A7931F
- SPKI SHA-256: 96C725EC776344C50771C95CBE7BDCBD22995B098569F727AE38B0EBDFF5BF7E
- Validity: 2022-06-08 to 2047-06-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:0e:d4:01:71:90:a0:1a:83:2c:4a:42:10:28:15:d2:61:1b:ad:32
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: Jun  8 10:53:13 2022 GMT
            Not After : Jun  8 10:53:13 2047 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
            X509v3 Subject Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9A12C392BFE57891A0C545309D4D9FD567E480CB613D6342278B195C79A7931F
    SPKI SHA256: 96C725EC776344C50771C95CBE7BDCBD22995B098569F727AE38B0EBDFF5BF7E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### SwissSign RSA SMIME Root CA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: B30511B116B4A056511D7C681F877D
- SHA-256: 5A84C94054D340D650A29985EF97BB396352E215AED6C0B33CA7FFDD3BD5D2A2
- SPKI SHA-256: 96C725EC776344C50771C95CBE7BDCBD22995B098569F727AE38B0EBDFF5BF7E
- Validity: 2022-06-28 to 2036-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b3:05:11:b1:16:b4:a0:56:51:1d:7c:68:1f:87:7d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Jun 28 11:26:01 2022 GMT
            Not After : Sep 22 11:26:01 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5A84C94054D340D650A29985EF97BB396352E215AED6C0B33CA7FFDD3BD5D2A2
    SPKI SHA256: 96C725EC776344C50771C95CBE7BDCBD22995B098569F727AE38B0EBDFF5BF7E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [current] warn w_sub_ca_aia_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp

### SwissSign RSA SMIME SV ICA 2024 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME SV ICA 2024 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 3E50FE6114AC70E44C4E7956BEC81FFC0F3B02EB
- SHA-256: 7E301988A102A5E93D2249666BB631020BA58FC703DE7B583E91D5449FD0D3AF
- SPKI SHA-256: E07454C9E5AAF8BF9534181F9508CC02F72305E10D42D9879D012CEB3FAC17A7
- Validity: 2024-05-28 to 2036-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-f4ed88c4-aae4-490a-99f8-8f5fd9ff751d
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 0.4.0.2042.1.1, 2.16.756.1.89.2.1.12, 2.16.756.1.89.2.1.13
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:50:fe:61:14:ac:70:e4:4c:4e:79:56:be:c8:1f:fc:0f:3b:02:eb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: May 28 09:03:21 2024 GMT
            Not After : May 28 09:03:21 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME SV ICA 2024 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.1
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 0.4.0.2042.1.1
                Policy: 2.16.756.1.89.2.1.12
                Policy: 2.16.756.1.89.2.1.13
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B8:EA:31:B3:DB:C6:43:FB:0D:60:D3:5C:A9:ED:9A:8B:E0:0E:B8:56
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7E301988A102A5E93D2249666BB631020BA58FC703DE7B583E91D5449FD0D3AF
    SPKI SHA256: E07454C9E5AAF8BF9534181F9508CC02F72305E10D42D9879D012CEB3FAC17A7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Microsoft Smartcard Login, Microsoft Encrypted File System
- Certificate Policies: 2.23.140.1.5.3.1, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 0.4.0.2042.1.1, 2.16.756.1.89.2.1.12, 2.16.756.1.89.2.1.13
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA SMIME SV ICA 2026 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME SV ICA 2026 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA SMIME Root CA 2022 - 1
- Serial: 4482B7458A282A9A7E5038961DA25145C4AC2BC2
- SHA-256: EFDB703F45B0083864361EF42C99BEB4A917BF7ED24967B3805A78662D4D4FA8
- SPKI SHA-256: B62DEEC420067309DA40989C38AED4A82194A1A7A812ACBD7B03846B87FF25A8
- Validity: 2026-06-10 to 2031-06-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-23ad7287-afab-4884-986a-42194a79d0d3
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.3, 2.16.756.1.89.2.1.12, 0.4.0.2042.1.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:82:b7:45:8a:28:2a:9a:7e:50:38:96:1d:a2:51:45:c4:ac:2b:c2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME Root CA 2022 - 1
        Validity
            Not Before: Jun 10 08:33:12 2026 GMT
            Not After : Jun 10 08:33:12 2031 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA SMIME SV ICA 2026 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.3
                Policy: 2.16.756.1.89.2.1.12
                Policy: 0.4.0.2042.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
            X509v3 Extended Key Usage:
                E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C8:B6:1B:C5:AD:EB:14:C8:20:7D:C4:AA:2D:D1:71:9D:39:D3:74:B8
            X509v3 Authority Key Identifier:
                CC:2E:AD:89:8C:83:E3:40:A3:25:69:A5:EA:92:7D:D2:37:3A:C7:C6
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EFDB703F45B0083864361EF42C99BEB4A917BF7ED24967B3805A78662D4D4FA8
    SPKI SHA256: B62DEEC420067309DA40989C38AED4A82194A1A7A812ACBD7B03846B87FF25A8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.3, 2.16.756.1.89.2.1.12, 0.4.0.2042.1.1
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-4a7f1788-26b5-48ec-a547-c1cd0bf17c3d
- CRL Distribution Points: http://crl.swisssign.ch/cdp-3ee55fd4-5938-41ee-82db-3223acef5c23
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS DV ICA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS DV ICA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1
- Serial: DE5886BE180A81FF5679BFB09AA767
- SHA-256: 0E55D0985482BBB7C490EBA147C5A021A2C2A2089D3A8AF57D01EDD540CA5A45
- SPKI SHA-256: 4ACD9D403822C512FD39146780F7BBB82CB01F0E7F13D424D96CE2CFDACB4F5B
- Validity: 2021-08-03 to 2036-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/3C9E527903636F4F9C811BD328700C245AEAA587
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.16.756.1.89.2.1.1, 2.23.140.1.2.1, 0.4.0.2042.1.6
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5, ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            de:58:86:be:18:0a:81:ff:56:79:bf:b0:9a:a7:67
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2021 - 1
        Validity
            Not Before: Aug  3 18:37:34 2021 GMT
            Not After : Jul 30 18:37:34 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS DV ICA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                3C:9E:52:79:03:63:6F:4F:9C:81:1B:D3:28:70:0C:24:5A:EA:A5:87
            X509v3 Authority Key Identifier:
                80:F3:8F:D9:FC:82:68:81:53:C1:E4:8B:97:50:1E:A9:F9:C6:1C:B5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.1
                Policy: 2.23.140.1.2.1
                Policy: 0.4.0.2042.1.6
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0E55D0985482BBB7C490EBA147C5A021A2C2A2089D3A8AF57D01EDD540CA5A45
    SPKI SHA256: 4ACD9D403822C512FD39146780F7BBB82CB01F0E7F13D424D96CE2CFDACB4F5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.16.756.1.89.2.1.1, 2.23.140.1.2.1, 0.4.0.2042.1.6
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
- CRL Distribution Points: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5, ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS DV ICA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS DV ICA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 75F85DDB06B0FA815891EA83C5CCFCE5578C190F
- SHA-256: B400250EF2B09B30E9AAA3E2C20017B8911BD039DF8AF54949C60AED5BF697D4
- SPKI SHA-256: 03B0175A3D6B8CACB054116A41C42FA071045877958833855EBC3346CF7CE177
- Validity: 2022-06-29 to 2036-06-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-679723b2-8641-4642-8500-f6d2ff37e6ba
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 2.16.756.1.89.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            75:f8:5d:db:06:b0:fa:81:58:91:ea:83:c5:cc:fc:e5:57:8c:19:0f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun 29 09:27:46 2022 GMT
            Not After : Jun 29 09:27:46 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS DV ICA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 0.4.0.2042.1.6
                Policy: 2.16.756.1.89.2.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                EB:BD:7F:49:93:8C:C9:EE:EC:A2:BA:F7:1C:D2:67:F0:83:B1:EA:DE
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B400250EF2B09B30E9AAA3E2C20017B8911BD039DF8AF54949C60AED5BF697D4
    SPKI SHA256: 03B0175A3D6B8CACB054116A41C42FA071045877958833855EBC3346CF7CE177
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 2.16.756.1.89.2.1.1
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
- CRL Distribution Points: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS DV ICA 2026 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS DV ICA 2026 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 5CEA8ED36492958D4F57D3CE50D9FC74326ABB0D
- SHA-256: D6073FEF5D143DA3CBCCA52F686E3542093F5E5F1A6A8F3A6BEBF65DCC9888F4
- SPKI SHA-256: 950476A03DE66A3318CE67B9144243DCAD18EADE241DD61DFCB1C7629792E42B
- Validity: 2026-06-10 to 2029-06-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-35b46c15-33d6-41f7-ae6f-cd856d54bc32
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 2.16.756.1.89.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:ea:8e:d3:64:92:95:8d:4f:57:d3:ce:50:d9:fc:74:32:6a:bb:0d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun 10 08:15:52 2026 GMT
            Not After : Jun 10 08:15:52 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS DV ICA 2026 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 0.4.0.2042.1.6
                Policy: 2.16.756.1.89.2.1.1
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                C3:62:C4:A3:37:46:01:83:89:53:82:68:78:0F:7D:73:1D:BF:7F:95
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D6073FEF5D143DA3CBCCA52F686E3542093F5E5F1A6A8F3A6BEBF65DCC9888F4
    SPKI SHA256: 950476A03DE66A3318CE67B9144243DCAD18EADE241DD61DFCB1C7629792E42B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1, 0.4.0.2042.1.6, 2.16.756.1.89.2.1.1
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
- CRL Distribution Points: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS EV ICA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS EV ICA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1
- Serial: CABBCFA7B09D6D87012AD5E9755255
- SHA-256: 39CB199F41C6A82AAD83C2810127596D02CC4EC766D0DFE31B01D50D1774749F
- SPKI SHA-256: BE14E2F2566538B692B75F06FAA531D8CF5387939CC8FE5B488A5BD56EF907EE
- Validity: 2021-08-03 to 2036-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: SwissSign AG
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/DA34D48E1023F46A2D6CB41FF32811DE5E01C4DE
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.16.756.1.89.2.1.3, 2.23.140.1.1, 0.4.0.2042.1.4
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5, ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ca:bb:cf:a7:b0:9d:6d:87:01:2a:d5:e9:75:52:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2021 - 1
        Validity
            Not Before: Aug  3 18:47:43 2021 GMT
            Not After : Jul 30 18:47:43 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS EV ICA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DA:34:D4:8E:10:23:F4:6A:2D:6C:B4:1F:F3:28:11:DE:5E:01:C4:DE
            X509v3 Authority Key Identifier:
                80:F3:8F:D9:FC:82:68:81:53:C1:E4:8B:97:50:1E:A9:F9:C6:1C:B5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.3
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 39CB199F41C6A82AAD83C2810127596D02CC4EC766D0DFE31B01D50D1774749F
    SPKI SHA256: BE14E2F2566538B692B75F06FAA531D8CF5387939CC8FE5B488A5BD56EF907EE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.16.756.1.89.2.1.3, 2.23.140.1.1, 0.4.0.2042.1.4
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
- CRL Distribution Points: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5, ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS EV ICA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS EV ICA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 2DAE0FA23A0C385FFBF395C0D903642D14184D2E
- SHA-256: 6AE61943BF4B4FCC8F08ED5044D1C97AA0AD40E1BCFE1BF1B530BD3B151B364D
- SPKI SHA-256: 067F63CC821FC4C53D4D97939CDCB63BDF1EF4D66274B804A6012847ABDF4FC7
- Validity: 2022-06-29 to 2036-06-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-9fdd910e-b9ff-4b2f-be38-2e93708c1b36
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 2.16.756.1.89.2.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:ae:0f:a2:3a:0c:38:5f:fb:f3:95:c0:d9:03:64:2d:14:18:4d:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun 29 09:30:47 2022 GMT
            Not After : Jun 29 09:30:47 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS EV ICA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 2.16.756.1.89.2.1.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                49:52:DF:30:86:92:59:5F:34:9C:25:48:24:AB:C0:EB:D1:06:F2:D6
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6AE61943BF4B4FCC8F08ED5044D1C97AA0AD40E1BCFE1BF1B530BD3B151B364D
    SPKI SHA256: 067F63CC821FC4C53D4D97939CDCB63BDF1EF4D66274B804A6012847ABDF4FC7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 2.16.756.1.89.2.1.3
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
- CRL Distribution Points: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS EV ICA 2026 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS EV ICA 2026 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 57742DB070DE71D48251BB44BD16A3C46F5C67D5
- SHA-256: 6FA62783E0FFDF8A9B1579B5766B07FD6B2AF2DC44F9CB9D6068B3EEDEFE20DB
- SPKI SHA-256: DB3697FE5463EB199F76159134F476AC414780FC22D18ED88B14BB7D8F86D03C
- Validity: 2026-06-10 to 2029-06-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-426c31ca-6f9a-4824-b50c-60bd9b57d4bd
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 2.16.756.1.89.2.1.3
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:74:2d:b0:70:de:71:d4:82:51:bb:44:bd:16:a3:c4:6f:5c:67:d5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun 10 08:25:07 2026 GMT
            Not After : Jun 10 08:25:07 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS EV ICA 2026 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 0.4.0.2042.1.4
                Policy: 2.16.756.1.89.2.1.3
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                80:77:B8:DB:CC:1C:4D:EB:3F:9D:B3:E2:0D:FD:26:F5:A6:67:57:AB
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6FA62783E0FFDF8A9B1579B5766B07FD6B2AF2DC44F9CB9D6068B3EEDEFE20DB
    SPKI SHA256: DB3697FE5463EB199F76159134F476AC414780FC22D18ED88B14BB7D8F86D03C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 0.4.0.2042.1.4, 2.16.756.1.89.2.1.3
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
- CRL Distribution Points: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS OV ICA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS OV ICA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1
- Serial: F4AC0694A66BDEB59851433B9B02BE
- SHA-256: B3679FDDDC644858B97DBB67DE778DD56C6E5D53A96B70E85AB509D09868186D
- SPKI SHA-256: 2348C9A5D8FB12D053C187FED603C90D90F2C355625854946D4838C7EC139601
- Validity: 2021-08-03 to 2036-07-30
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/ACD03AC2C25755916911CC706A59388A8CAC9C3D
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.16.756.1.89.2.1.2, 2.23.140.1.2.2, 0.4.0.2042.1.7
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5, ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f4:ac:06:94:a6:6b:de:b5:98:51:43:3b:9b:02:be
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2021 - 1
        Validity
            Not Before: Aug  3 18:50:06 2021 GMT
            Not After : Jul 30 18:50:06 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS OV ICA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                AC:D0:3A:C2:C2:57:55:91:69:11:CC:70:6A:59:38:8A:8C:AC:9C:3D
            X509v3 Authority Key Identifier:
                80:F3:8F:D9:FC:82:68:81:53:C1:E4:8B:97:50:1E:A9:F9:C6:1C:B5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.2.1.2
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B3679FDDDC644858B97DBB67DE778DD56C6E5D53A96B70E85AB509D09868186D
    SPKI SHA256: 2348C9A5D8FB12D053C187FED603C90D90F2C355625854946D4838C7EC139601
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.16.756.1.89.2.1.2, 2.23.140.1.2.2, 0.4.0.2042.1.7
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
- CRL Distribution Points: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5, ldap://directory.swisssign.net/CN=80F38FD9FC82688153C1E48B97501EA9F9C61CB5%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS OV ICA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS OV ICA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 6AEC7C44417B9B441FB97634CBC6A780B0041E01
- SHA-256: 332F9EAE3650C77454AF14FE1A621A2498FD128773662890A0D12835B3436E23
- SPKI SHA-256: F62BBA132E7DE440F928B316D40DCD48C7FF49F9FDADD81ABEB2FD0D21F067C6
- Validity: 2022-06-29 to 2036-06-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-96b62f5a-6b73-4da4-87f7-ce4002c1cd34
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 2.16.756.1.89.2.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:ec:7c:44:41:7b:9b:44:1f:b9:76:34:cb:c6:a7:80:b0:04:1e:01
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun 29 09:34:30 2022 GMT
            Not After : Jun 29 09:34:30 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS OV ICA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 2.16.756.1.89.2.1.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                7C:6F:0A:6F:13:0F:D9:8C:24:6F:26:34:F3:5C:6B:43:6D:B7:23:B6
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 332F9EAE3650C77454AF14FE1A621A2498FD128773662890A0D12835B3436E23
    SPKI SHA256: F62BBA132E7DE440F928B316D40DCD48C7FF49F9FDADD81ABEB2FD0D21F067C6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 2.16.756.1.89.2.1.2
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
- CRL Distribution Points: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS OV ICA 2026 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS OV ICA 2026 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 44026BA335B36A02B1536C5558D9FDFFB9904D91
- SHA-256: CFD692D83CB455C1E068355D7AABBD5EBD631A42389228822926432D2FB8B1C3
- SPKI SHA-256: 28AEC543C286CA73174586D34F86A3297E2EA49C1EDCAAFEABEA3F2C6FA7D927
- Validity: 2026-06-10 to 2029-06-10
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-6f23d9c8-ac2d-4317-ac7a-6a505f0f5cf2
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 2.16.756.1.89.2.1.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:02:6b:a3:35:b3:6a:02:b1:53:6c:55:58:d9:fd:ff:b9:90:4d:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun 10 08:29:21 2026 GMT
            Not After : Jun 10 08:29:21 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS OV ICA 2026 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                Policy: 0.4.0.2042.1.7
                Policy: 2.16.756.1.89.2.1.2
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                32:37:01:8D:BC:7A:48:AD:83:35:D0:62:48:91:1A:F9:6E:DB:A6:09
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CFD692D83CB455C1E068355D7AABBD5EBD631A42389228822926432D2FB8B1C3
    SPKI SHA256: 28AEC543C286CA73174586D34F86A3297E2EA49C1EDCAAFEABEA3F2C6FA7D927
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2, 0.4.0.2042.1.7, 2.16.756.1.89.2.1.2
- AIA OCSP: -
- AIA CA Issuers: http://aia.swisssign.ch/air-aeff374d-0f7a-4c55-a034-1440290cfa32
- CRL Distribution Points: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### SwissSign RSA TLS Root CA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: A96DDC39D36EBF15A4993FD028B476
- SHA-256: 4E5666DAC579161CF00B8D87046D074D6C9C0C0E3994C653BE57998736C55D93
- SPKI SHA-256: 9D468E1E6ED0B03E976A0AE3C65D613EED87143A5789A984BE30D9D48A16C76E
- Validity: 2021-08-03 to 2036-10-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a9:6d:dc:39:d3:6e:bf:15:a4:99:3f:d0:28:b4:76
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Aug  3 13:47:19 2021 GMT
            Not After : Oct 23 13:47:19 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:F3:8F:D9:FC:82:68:81:53:C1:E4:8B:97:50:1E:A9:F9:C6:1C:B5
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4E5666DAC579161CF00B8D87046D074D6C9C0C0E3994C653BE57998736C55D93
    SPKI SHA256: 9D468E1E6ED0B03E976A0AE3C65D613EED87143A5789A984BE30D9D48A16C76E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_sub_ca_certificate_policies_missing: 
- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [historical] warn w_sub_ca_aia_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_http_urls
- has_crldp

### SwissSign RSA TLS Root CA 2021 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2021 - 1
- Serial: 576ABDFAC05A058B3F7C65E39BA53E
- SHA-256: 7EB8F631AD1C8408E9716AE920BCD677973B059E990AED01DDA5E1C5970B402C
- SPKI SHA-256: 9D468E1E6ED0B03E976A0AE3C65D613EED87143A5789A984BE30D9D48A16C76E
- Validity: 2021-08-02 to 2046-07-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            57:6a:bd:fa:c0:5a:05:8b:3f:7c:65:e3:9b:a5:3e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2021 - 1
        Validity
            Not Before: Aug  2 11:20:23 2021 GMT
            Not After : Jul 27 11:20:23 2046 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2021 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:F3:8F:D9:FC:82:68:81:53:C1:E4:8B:97:50:1E:A9:F9:C6:1C:B5
            X509v3 Authority Key Identifier:
                80:F3:8F:D9:FC:82:68:81:53:C1:E4:8B:97:50:1E:A9:F9:C6:1C:B5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 7EB8F631AD1C8408E9716AE920BCD677973B059E990AED01DDA5E1C5970B402C
    SPKI SHA256: 9D468E1E6ED0B03E976A0AE3C65D613EED87143A5789A984BE30D9D48A16C76E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### SwissSign RSA TLS Root CA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 686F43B4DC404C067E230E3FAFC32B
- SHA-256: 288B4A9F605B09B999B215850825C81F9B537DBAF23664ACA98BF6BA98EDC379
- SPKI SHA-256: EBC978AE0DD9E5822D6B19652596F620C93D7CAEFA952191CB050A632CA9005F
- Validity: 2022-06-28 to 2036-09-22
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            68:6f:43:b4:dc:40:4c:06:7e:23:0e:3f:af:c3:2b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Jun 28 11:27:11 2022 GMT
            Not After : Sep 22 11:27:11 2036 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 288B4A9F605B09B999B215850825C81F9B537DBAF23664ACA98BF6BA98EDC379
    SPKI SHA256: EBC978AE0DD9E5822D6B19652596F620C93D7CAEFA952191CB050A632CA9005F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 
- [current] warn w_sub_ca_aia_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp

### SwissSign RSA TLS Root CA 2022 - 1

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign RSA TLS Root CA 2022 - 1
- Serial: 43FA0C5F4E1B801844EFD1B44F351F44F480EDCB
- SHA-256: 193144F431E0FDDB740717D4DE926A571133884B4360D30E272913CBE660CE41
- SPKI SHA-256: EBC978AE0DD9E5822D6B19652596F620C93D7CAEFA952191CB050A632CA9005F
- Validity: 2022-06-08 to 2047-06-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.ch/cdp-9661c29f-9121-4f46-acd8-ead4a22f7160
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:fa:0c:5f:4e:1b:80:18:44:ef:d1:b4:4f:35:1f:44:f4:80:ed:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Validity
            Not Before: Jun  8 11:08:22 2022 GMT
            Not After : Jun  8 11:08:22 2047 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign RSA TLS Root CA 2022 - 1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Authority Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
            X509v3 Subject Key Identifier:
                6F:8E:62:8B:93:43:B0:E1:40:F6:A7:C3:FD:F1:0F:B8:0F:15:38:A5
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 193144F431E0FDDB740717D4DE926A571133884B4360D30E272913CBE660CE41
    SPKI SHA256: EBC978AE0DD9E5822D6B19652596F620C93D7CAEFA952191CB050A632CA9005F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### SwissSign Server Gold CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Gold CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 5ECCFA69C03327EF
- SHA-256: FD2991B134CE57BF9CD686878854A5EED5EA64433002452BA40398DA78845CA7
- SPKI SHA-256: E30AC97DEBCF15CC43FD4E2D889336ED1275838CE36EEF81DDE4E00BFA8FC468
- Validity: 2008-07-07 to 2023-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/9776DE0A34E5109A40C4EBD89D5A537B21CC473E
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6831110066917287919 (0x5eccfa69c03327ef)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Jul  7 17:06:03 2008 GMT
            Not After : Jul  7 17:06:03 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Server Gold CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                97:76:DE:0A:34:E5:10:9A:40:C4:EB:D8:9D:5A:53:7B:21:CC:47:3E
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.3
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: FD2991B134CE57BF9CD686878854A5EED5EA64433002452BA40398DA78845CA7
    SPKI SHA256: E30AC97DEBCF15CC43FD4E2D889336ED1275838CE36EEF81DDE4E00BFA8FC468
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Server Gold CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Gold CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 90EF71773BA96BF728BE53F0B653CE
- SHA-256: 11EF7BA62109144944F15CAD40C3F9FA860683A63551E603395CF05B2298D999
- SPKI SHA-256: AFFF8A29EDEADEB1810A5C02FDC6F89A2F65E8799AE62AAEF9DC277E89AEA94F
- Validity: 2014-09-15 to 2029-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            90:ef:71:77:3b:a9:6b:f7:28:be:53:f0:b6:53:ce
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Sep 15 16:12:47 2014 GMT
            Not After : Sep 11 16:12:47 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Server Gold CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                A5:86:59:36:72:C6:5B:24:D5:2B:91:8C:F3:18:52:3E:E5:95:4C:CD
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.4
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 11EF7BA62109144944F15CAD40C3F9FA860683A63551E603395CF05B2298D999
    SPKI SHA256: AFFF8A29EDEADEB1810A5C02FDC6F89A2F65E8799AE62AAEF9DC277E89AEA94F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.4
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Server Gold CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Gold CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: FA1DAAEAC9B3A5FA57980B9974DA31
- SHA-256: 561DC78351F5E7EE5A464AC6E58A0D164EF2768F98F02E6EE65501120FCD9C5E
- SPKI SHA-256: B24CA8CDD9A9D78D258EB1EF8D18A3AB7BF6FF24359F27C5C81880F6E38ABB0F
- Validity: 2014-09-19 to 2029-09-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/E7F1E7FD2E53AD11E5811A57A4738F127D98C8AE
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fa:1d:aa:ea:c9:b3:a5:fa:57:98:0b:99:74:da:31
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Sep 19 14:09:12 2014 GMT
            Not After : Sep 15 14:09:12 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Server Gold CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E7:F1:E7:FD:2E:53:AD:11:E5:81:1A:57:A4:73:8F:12:7D:98:C8:AE
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.2.1.6
                  CPS: http://repository.swisssign.com/SwissSign-Gold-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
                OCSP - URI:http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 561DC78351F5E7EE5A464AC6E58A0D164EF2768F98F02E6EE65501120FCD9C5E
    SPKI SHA256: B24CA8CDD9A9D78D258EB1EF8D18A3AB7BF6FF24359F27C5C81880F6E38ABB0F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.2.1.6
- AIA OCSP: http://ocsp.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Server Silver CA 2008 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Silver CA 2008 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 9D154E306A8BA0CE
- SHA-256: 06E5DEC31C91D7D33435201D2E22116C207193A874E0A426532A2F69530C86B5
- SPKI SHA-256: A5DC3EB3390585A2C7C39EAFB1DFDE575F6765DF2D95869BB3A89EF65937BF3D
- Validity: 2008-07-07 to 2023-07-07
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/D3446FD9FE7AFCDEAC1C7AA2210D64FA65B0D782
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.3
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9d:15:4e:30:6a:8b:a0:ce
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Jul  7 17:07:16 2008 GMT
            Not After : Jul  7 17:07:16 2023 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Server Silver CA 2008 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                D3:44:6F:D9:FE:7A:FC:DE:AC:1C:7A:A2:21:0D:64:FA:65:B0:D7:82
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.3
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 06E5DEC31C91D7D33435201D2E22116C207193A874E0A426532A2F69530C86B5
    SPKI SHA256: A5DC3EB3390585A2C7C39EAFB1DFDE575F6765DF2D95869BB3A89EF65937BF3D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.3
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign Server Silver CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Silver CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 6AD706CF528A1954C39D75B9D0BD40
- SHA-256: 73942E29DF7DF03440A880A94435A5941856779741B6E102BA41A586D01ACA02
- SPKI SHA-256: 39B11789C249D80005BD5F3FB31DDF32CF54F768634BB38024CE6705A5E3A15C
- Validity: 2014-09-15 to 2029-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.4
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6a:d7:06:cf:52:8a:19:54:c3:9d:75:b9:d0:bd:40
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 15 15:36:09 2014 GMT
            Not After : Sep 11 15:36:09 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Server Silver CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                B1:E2:3B:85:9F:22:72:0C:AF:13:1F:D6:37:27:42:64:0E:2D:04:C1
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.4
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                OCSP - URI:http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 73942E29DF7DF03440A880A94435A5941856779741B6E102BA41A586D01ACA02
    SPKI SHA256: 39B11789C249D80005BD5F3FB31DDF32CF54F768634BB38024CE6705A5E3A15C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.4
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign Server Silver CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Server Silver CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 6BC318C92ACD1763EB41C86FAF47F7
- SHA-256: 67F91F26F5BFBFA48738BE0678DD2F8F75F7B80761D5656783CA8B920AAA5659
- SPKI SHA-256: 989C1C480D561396DF0AC439A3BF70182BDAB2FC1D56CCE7665A91D47DD83DD2
- Validity: 2014-09-19 to 2029-09-15
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/DBBCBF821859DC69FAF8ABAA834D771D0BB08BD8
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.6
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:c3:18:c9:2a:cd:17:63:eb:41:c8:6f:af:47:f7
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 19 20:36:43 2014 GMT
            Not After : Sep 15 20:36:43 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign Server Silver CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                DB:BC:BF:82:18:59:DC:69:FA:F8:AB:AA:83:4D:77:1D:0B:B0:8B:D8
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: 2.16.756.1.89.1.3.1.6
                  CPS: http://repository.swisssign.com/SwissSign-Silver-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                OCSP - URI:http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 67F91F26F5BFBFA48738BE0678DD2F8F75F7B80761D5656783CA8B920AAA5659
    SPKI SHA256: 989C1C480D561396DF0AC439A3BF70182BDAB2FC1D56CCE7665A91D47DD83DD2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.16.756.1.89.1.3.1.6
- AIA OCSP: http://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### SwissSign SuisseID Platinum CA 2010 - G2

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign SuisseID Platinum CA 2010 - G2
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: D5CB89C293009BEDBD014BDC109602
- SHA-256: 395995EF7D204CD7F7E67480E348766EFD93D5CDADC8DBE7DF5D4B39F5C32410
- SPKI SHA-256: B32FC91DDA629262BD9C07FD8059FCA48CFB669283B687F9E729F7F644F1E3F1
- Validity: 2010-03-08 to 2025-03-04
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/E944868092EA4E5077C9E7920842D75FC0C22542
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d5:cb:89:c2:93:00:9b:ed:bd:01:4b:dc:10:96:02
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Mar  8 14:05:04 2010 GMT
            Not After : Mar  4 14:05:04 2025 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign SuisseID Platinum CA 2010 - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                E9:44:86:80:92:EA:4E:50:77:C9:E7:92:08:42:D7:5F:C0:C2:25:42
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS-R3.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 395995EF7D204CD7F7E67480E348766EFD93D5CDADC8DBE7DF5D4B39F5C32410
    SPKI SHA256: B32FC91DDA629262BD9C07FD8059FCA48CFB669283B687F9E729F7F644F1E3F1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### SwissSign SuisseID Platinum CA 2014 - G22

- Subject: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign SuisseID Platinum CA 2014 - G22
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Platinum CA - G2
- Serial: E2A367DDB9881940A8485E5541A9FD
- SHA-256: 122071FD4527C2997A2F8366A6D3CE12E085BD74199AC5133829F68F06E9832A
- SPKI SHA-256: 73CD9B06F480E95F2BDC62087B695A827D448E6DF6B38EB4A6D30B564BE17514
- Validity: 2014-09-15 to 2029-09-11
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.swisssign.net/F0904C8BE1F002DE00016B98E7EEDC518DDB40AE
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL DP: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e2:a3:67:dd:b9:88:19:40:a8:48:5e:55:41:a9:fd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Platinum CA - G2
        Validity
            Not Before: Sep 15 16:23:36 2014 GMT
            Not After : Sep 11 16:23:36 2029 GMT
        Subject: C = CH, O = SwissSign AG, CN = SwissSign SuisseID Platinum CA 2014 - G22
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Subject Key Identifier:
                F0:90:4C:8B:E1:F0:02:DE:00:01:6B:98:E7:EE:DC:51:8D:DB:40:AE
            X509v3 Authority Key Identifier:
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf
            Authority Information Access:
                CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
                OCSP - URI:http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 122071FD4527C2997A2F8366A6D3CE12E085BD74199AC5133829F68F06E9832A
    SPKI SHA256: 73CD9B06F480E95F2BDC62087B695A827D448E6DF6B38EB4A6D30B564BE17514
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- AIA CA Issuers: http://swisssign.net/cgi-bin/authority/download/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC
- CRL Distribution Points: http://crl.swisssign.net/50AFCC078715476F38C5B465D1DE95AAE9DF9CCC, ldap://directory.swisssign.net/CN=50AFCC078715476F38C5B465D1DE95AAE9DF9CCC%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Trend Micro Gold CA

- Subject: countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Gold CA
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: A0369BD7E28FF4130B0F5346F6648A
- SHA-256: 9C6BA9A0922D889935888F257D99BB8BADA6E38F10DA7FC4D55F51F90DEF9BF1
- SPKI SHA-256: 6AABF722ED23B921B0EB8720C218B14FFDD1DECB8278A040DF978BFCAFE22381
- Validity: 2011-09-29 to 2017-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a0:36:9b:d7:e2:8f:f4:13:0b:0f:53:46:f6:64:8a
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Sep 29 20:45:06 2011 GMT
            Not After : Nov  1 20:45:06 2017 GMT
        Subject: C = US, O = Trend Micro Inc, CN = Trend Micro Gold CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3E:33:CD:B7:D2:E6:A0:AB:F9:E1:97:E0:B1:2F:35:83:3A:EF:72:61
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http:// http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 9C6BA9A0922D889935888F257D99BB8BADA6E38F10DA7FC4D55F51F90DEF9BF1
    SPKI SHA256: 6AABF722ED23B921B0EB8720C218B14FFDD1DECB8278A040DF978BFCAFE22381
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Trend Micro Gold CA

- Subject: countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Gold CA
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 49E1336E94E5B6A52DA96ED48AE276
- SHA-256: 98C967747ED97A1D9E1767A986B796165D9E95EFAD3D68FC5712E4AE97D5F21C
- SPKI SHA-256: 6AABF722ED23B921B0EB8720C218B14FFDD1DECB8278A040DF978BFCAFE22381
- Validity: 2009-12-01 to 2019-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:e1:33:6e:94:e5:b6:a5:2d:a9:6e:d4:8a:e2:76
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Dec  1 12:00:00 2009 GMT
            Not After : Nov  1 12:00:00 2019 GMT
        Subject: C = US, O = Trend Micro Inc, CN = Trend Micro Gold CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3E:33:CD:B7:D2:E6:A0:AB:F9:E1:97:E0:B1:2F:35:83:3A:EF:72:61
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 98C967747ED97A1D9E1767A986B796165D9E95EFAD3D68FC5712E4AE97D5F21C
    SPKI SHA256: 6AABF722ED23B921B0EB8720C218B14FFDD1DECB8278A040DF978BFCAFE22381
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Trend Micro Gold CA

- Subject: countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Gold CA
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Gold CA - G2
- Serial: 49E1336E94E5B6A52DA96ED48AE276
- SHA-256: 6608D839E79554E51475124729EBF4A9724EA63D54B430FC0E7E3B60A0C817B2
- SPKI SHA-256: 6AABF722ED23B921B0EB8720C218B14FFDD1DECB8278A040DF978BFCAFE22381
- Validity: 2009-12-01 to 2019-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            49:e1:33:6e:94:e5:b6:a5:2d:a9:6e:d4:8a:e2:76
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Gold CA - G2
        Validity
            Not Before: Dec  1 12:00:00 2009 GMT
            Not After : Nov  2 07:03:46 2019 GMT
        Subject: C = US, O = Trend Micro Inc, CN = Trend Micro Gold CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                3E:33:CD:B7:D2:E6:A0:AB:F9:E1:97:E0:B1:2F:35:83:3A:EF:72:61
            X509v3 Authority Key Identifier:
                5B:25:7B:96:A4:65:51:7E:B8:39:F3:C0:78:66:5E:E8:3A:E7:F0:EE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6608D839E79554E51475124729EBF4A9724EA63D54B430FC0E7E3B60A0C817B2
    SPKI SHA256: 6AABF722ED23B921B0EB8720C218B14FFDD1DECB8278A040DF978BFCAFE22381
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE, ldap://directory.swisssign.net/CN=5B257B96A465517EB839F3C078665EE83AE7F0EE%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Trend Micro Silver CA

- Subject: countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Silver CA
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: DB00C83B924ACED9F372DF319F930F
- SHA-256: 0C7E4FE087D526D70C3FD32C6EFA3D018275917644137015D4EA3669BE820A4B
- SPKI SHA-256: 06C41FEDFD62F14B6F0731BB2FB9A4452B90CDFD41A82A73874EB06993A2B510
- Validity: 2009-12-01 to 2019-11-02
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf, https://cert.webtrust.org/SealFile?seal=2116&file=pdf, https://cert.webtrust.org/SealFile?seal=2093&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            db:00:c8:3b:92:4a:ce:d9:f3:72:df:31:9f:93:0f
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Dec  1 12:00:00 2009 GMT
            Not After : Nov  2 07:03:51 2019 GMT
        Subject: C = US, O = Trend Micro Inc, CN = Trend Micro Silver CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                F4:CC:58:EF:38:57:9F:BC:67:79:9C:38:D2:C4:7E:D2:12:B0:DD:CD
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 0C7E4FE087D526D70C3FD32C6EFA3D018275917644137015D4EA3669BE820A4B
    SPKI SHA256: 06C41FEDFD62F14B6F0731BB2FB9A4452B90CDFD41A82A73874EB06993A2B510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired

### Trend Micro Silver CA

- Subject: countryName=US, organizationName=Trend Micro Inc, commonName=Trend Micro Silver CA
- Issuer: countryName=CH, organizationName=SwissSign AG, commonName=SwissSign Silver CA - G2
- Serial: 9F3484A1E39C4C77317A09FAD54949
- SHA-256: 2C2BECF013B5EE905094C1D63C652C0BF3CCE11DCF698F91AF76A839499AF601
- SPKI SHA-256: 06C41FEDFD62F14B6F0731BB2FB9A4452B90CDFD41A82A73874EB06993A2B510
- Validity: 2011-09-29 to 2017-11-01
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://www.affirmtrust.com/resources/cps, http://www.affirmtrust.com/resources/cps
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2115&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: -
- CRL DP: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9f:34:84:a1:e3:9c:4c:77:31:7a:09:fa:d5:49:49
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
        Validity
            Not Before: Sep 29 20:45:05 2011 GMT
            Not After : Nov  1 20:45:05 2017 GMT
        Subject: C = US, O = Trend Micro Inc, CN = Trend Micro Silver CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                F4:CC:58:EF:38:57:9F:BC:67:79:9C:38:D2:C4:7E:D2:12:B0:DD:CD
            X509v3 Authority Key Identifier:
                17:A0:CD:C1:E4:41:B6:3A:5B:3B:CB:45:9D:BD:1C:C2:98:FA:86:58
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658
                Full Name:
                  URI:ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://www.affirmtrust.com/resources/cps
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 2C2BECF013B5EE905094C1D63C652C0BF3CCE11DCF698F91AF76A839499AF601
    SPKI SHA256: 06C41FEDFD62F14B6F0731BB2FB9A4452B90CDFD41A82A73874EB06993A2B510
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658, ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC298FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistributionPoint
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- is_expired
