# CA Owner Audit Dump - Telia Company

Generated: 2026-07-28T05:57:02.975665Z

## CA Owner Summary

- Name: Telia Company
- Country: Sweden
- Website: -
- Problem Reporting: cainfo[at]telia[dot]fi, ca-problems[at]telia[dot]fi, https://support.trust.telia.com/palvelinvarmenneturvallisuus_en.html
- CP/CPS URLs: http://repository.trust.teliasonera.com/CPS/index3.html, https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf, https://cps.trust.telia.com/SMIMEv12/teliacasmimecpcps.html, https://cps.trust.telia.com/TLSv67/teliacatlscpcps.html, https://repository.trust.teliasonera.com/TeliaSonera_Production_CPS_v2.3.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2061&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab7b3bcf-077f-4b23-9ad6-2859bdac0677, https://bugzilla.mozilla.org/attachment.cgi?id=9283224, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-9_AAL_SMIME-BR_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-8_AAL_TLS-BR_Audit_Telia_V1.pdf
- Root Programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: cainfo[at]telia[dot]fi, ca-problems[at]telia[dot]fi, https://support.trust.telia.com/palvelinvarmenneturvallisuus_en.html
- CP/CPS URLs: http://repository.trust.teliasonera.com/CPS/index3.html, https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf, https://cps.trust.telia.com/SMIMEv12/teliacasmimecpcps.html, https://cps.trust.telia.com/TLSv67/teliacatlscpcps.html, https://repository.trust.teliasonera.com/TeliaSonera_Production_CPS_v2.3.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2061&file=pdf, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab7b3bcf-077f-4b23-9ad6-2859bdac0677, https://bugzilla.mozilla.org/attachment.cgi?id=9283224, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-9_AAL_SMIME-BR_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-8_AAL_TLS-BR_Audit_Telia_V1.pdf
- Repository URLs: https://cps.trust.telia.com/, https://repository.trust.teliasonera.com, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- Root programs: {"mozilla":"Removed","chrome":"Not Included","microsoft":"Removed","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=FI, organizationName=Sonera, commonName=Sonera Class1 CA | yes | expired | 2001-04-06 to 2021-04-06 | - | - | - | historical errors: 2 |
| 2 | countryName=FI, organizationName=Sonera, commonName=Sonera Class2 CA | yes | expired | 2001-04-06 to 2021-04-06 | - | - | - | historical errors: 2 |
| 3 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Client Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | current errors: 1 |
| 4 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Email Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | current errors: 1 |
| 5 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Signing Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | current errors: 1 |
| 6 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | current errors: 1 |
| 7 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | clean |
| 8 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | clean |
| 9 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Signing Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | clean |
| 10 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3 | yes | unknown | 2023-11-15 to 2048-05-23 | - | - | - | clean |
| 11 | organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1 | yes | unknown | 2007-10-18 to 2032-10-18 | - | - | - | current errors: 2 |
| 12 | organizationName=Ericsson, commonName=Ericsson NL Individual CA v2 | yes | revoked, expired | 2014-05-27 to 2024-05-27 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 13 | countryName=SE, organizationName=Ericsson, commonName=Ericsson NL Individual CA v3 | yes | expired | 2015-10-27 to 2025-10-27 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 14 | countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v4 | yes | revoked | 2022-05-17 to 2043-11-29 | 1.3.6.1.4.1.271.2.3.1.1.18 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 15 | countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v4 | yes | current | 2023-08-16 to 2043-11-29 | 1.3.6.1.4.1.271.2.3.1.1.18, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 16 | countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v5 | yes | revoked | 2024-03-25 to 2048-05-23 | 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.271.2.3.1.1.18 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 17 | countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v5 | yes | current | 2025-06-16 to 2048-05-23 | 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.271.2.3.1.1.18 | 0 | TLS Web Client Authentication, E-mail Protection | current errors: 1 |
| 18 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Class 1 CA v3 | yes | revoked | 2021-05-19 to 2043-11-28 | 1.3.6.1.4.1.271.2.3.1.1.11 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 19 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Class 1 CA v3 | yes | current | 2023-08-16 to 2043-11-28 | 1.3.6.1.4.1.271.2.3.1.1.11, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 20 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 2 CA v3 | yes | revoked | 2021-05-19 to 2043-11-28 | 1.3.6.1.4.1.271.2.3.1.1.12 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 21 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 2 CA v3 | yes | current | 2023-08-16 to 2043-11-28 | 1.3.6.1.4.1.271.2.3.1.1.12, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 22 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 3 CA v1 | yes | revoked | 2020-11-12 to 2043-11-25 | 1.3.6.1.4.1.271.2.3.1.1.13 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12 | clean |
| 23 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 3 CA v2 | yes | revoked | 2023-10-27 to 2032-10-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 24 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 3 CA v3 | yes | current | 2024-04-17 to 2032-10-17 | 2.5.29.32.0 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 25 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v1 | yes | revoked | 2017-11-28 to 2032-10-18 | 2.5.29.32.0 | 0 | - | clean |
| 26 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v2 | yes | revoked | 2018-08-29 to 2032-10-18 | 1.3.6.1.4.1.271.2.3.1.1.20 | 0 | - | clean |
| 27 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v3 | yes | revoked | 2019-09-06 to 2043-11-29 | 1.3.6.1.4.1.271.2.3.1.1.20 | 0 | - | clean |
| 28 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v3 | yes | current | 2019-09-10 to 2043-11-29 | 1.3.6.1.4.1.271.2.3.1.1.20 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12 | clean |
| 29 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Domain Validation CA v2 | yes | revoked | 2018-08-29 to 2032-10-18 | 2.23.140.1.2.1 | 0 | - | clean |
| 30 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Domain Validation CA v3 | yes | current | 2018-11-29 to 2043-11-29 | 2.23.140.1.2.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 31 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Domain Validation SSL CA v1 | yes | revoked | 2018-02-19 to 2032-10-16 | 2.23.140.1.2.1 | 0 | - | clean |
| 32 | countryName=FI, organizationName=Telia, commonName=Telia Domain Validation SSL CA v1 | yes | revoked | 2017-11-16 to 2032-10-16 | 2.23.140.1.2.1 | 0 | - | clean |
| 33 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Client Root CA v3 | yes | current | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 34 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC DV CA v4 | yes | revoked | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 35 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC DV CA v4 | yes | current | 2024-12-19 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 36 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Email Root CA v3 | yes | current | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 37 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Signing Root CA v3 | yes | current | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 38 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3 | yes | current | 2024-12-19 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Server Authentication | current errors: 1 |
| 39 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3 | yes | revoked | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 40 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3 | yes | revoked | 2024-12-19 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Server Authentication | historical errors: 1 |
| 41 | countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3 | yes | revoked | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | historical errors: 1 |
| 42 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Email CA v5 | yes | current | 2023-08-16 to 2043-11-28 | 1.3.6.1.4.1.271.2.3.1.1.14, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 43 | countryName=SE, organizationName=Telia Company AB, commonName=Telia Email CA v5 | yes | revoked | 2021-05-19 to 2043-11-28 | 1.3.6.1.4.1.271.2.3.1.1.14 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 44 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Extended Validation CA v3 | yes | revoked | 2018-11-29 to 2043-11-29 | 2.23.140.1.1 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 45 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2 | yes | current | 2018-11-29 to 2043-11-29 | - | - | - | clean |
| 46 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2 | yes | current | 2018-11-29 to 2032-10-18 | 2.5.29.32.0 | - | - | clean |
| 47 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client 1 CA v4 | yes | current | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 48 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client 2 CA v4 | yes | current | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication | clean |
| 49 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client 3 CA v4 | yes | current | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 50 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3 | yes | current | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 51 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA DV CA v4 | yes | current | 2024-12-19 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 52 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA DV CA v4 | yes | revoked | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 53 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email CA v6 | yes | current | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 54 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3 | yes | current | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, E-mail Protection | clean |
| 55 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA OV CA v4 | yes | current | 2024-12-19 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 56 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA OV CA v4 | yes | revoked | 2024-03-25 to 2048-05-23 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 57 | countryName=SE, organizationIdentifier=NTRSE-556103-4249, organizationName=Telia Company AB, commonName=Telia RSA qSeal CA v4 | yes | current | 2024-03-25 to 2048-05-23 | 0.4.0.194112.1.3, 1.3.6.1.4.1.271.2.3.1.1.20 | 0 | 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 58 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Signing Root CA v3 | yes | current | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12 | clean |
| 59 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3 | yes | revoked | 2023-11-15 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 60 | countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3 | yes | current | 2024-12-19 to 2043-11-28 | 2.5.29.32.0 | - | TLS Web Server Authentication | clean |
| 61 | countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Server CA v3 | yes | current | 2018-11-29 to 2043-11-29 | 2.23.140.1.2.2 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 62 | organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v1 | yes | expired | 2007-10-24 to 2019-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 63 | organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v1 | yes | revoked | 2013-05-13 to 2032-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | historical errors: 1 |
| 64 | countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v2 | yes | current | 2023-08-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.11 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 65 | countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v2 | yes | revoked | 2014-10-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 66 | organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v1 | yes | expired | 2007-10-18 to 2019-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 67 | organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v1 | yes | revoked | 2013-05-13 to 2032-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | historical errors: 1 |
| 68 | countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v2 | yes | revoked | 2014-10-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 69 | countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v2 | yes | revoked | 2023-08-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.12 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 70 | organizationName=TeliaSonera, commonName=TeliaSonera Email CA v3 | yes | expired | 2007-10-18 to 2019-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 71 | organizationName=TeliaSonera, commonName=TeliaSonera Email CA v3 | yes | revoked | 2013-05-13 to 2032-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | historical errors: 1 |
| 72 | countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Email CA v4 | yes | revoked | 2023-08-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.14, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 73 | countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Email CA v4 | yes | revoked | 2014-10-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 74 | countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Extended Validation SSL CA v1 | yes | revoked | 2015-03-16 to 2032-10-17 | 2.5.29.32.0 | 0 | - | clean |
| 75 | organizationName=TeliaSonera, commonName=TeliaSonera Gateway CA v1 | yes | revoked | 2013-05-13 to 2032-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | historical errors: 1 |
| 76 | organizationName=TeliaSonera, commonName=TeliaSonera Gateway CA v1 | yes | revoked | 2010-03-04 to 2032-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 77 | countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Gateway CA v2 | yes | revoked | 2014-10-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 78 | countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v1 | yes | revoked | 2014-10-16 to 2032-10-16 | 1.2.246.277.1.11.4.1.2.1 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 79 | countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v1 | yes | revoked | 2018-05-23 to 2032-10-16 | 1.2.246.277.1.11.4.1.2.1 | 0 | TLS Web Client Authentication | clean |
| 80 | countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v2 | yes | current | 2018-02-19 to 2032-10-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, Time Stamping | clean |
| 81 | countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v2 | yes | revoked | 2016-01-26 to 2032-10-17 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, Time Stamping | clean |
| 82 | organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1 | yes | expired | 2007-10-18 to 2019-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | - | - | clean |
| 83 | organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1 | yes | expired | 2014-12-05 to 2021-04-05 | 1.3.6.1.4.1.271.2.3.1.1.2 | - | - | historical errors: 1 |
| 84 | organizationName=TeliaSonera, commonName=TeliaSonera Server CA v1 | yes | revoked | 2013-05-13 to 2032-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | historical errors: 1 |
| 85 | organizationName=TeliaSonera, commonName=TeliaSonera Server CA v1 | yes | expired | 2007-10-24 to 2019-10-17 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |
| 86 | countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Server CA v2 | yes | revoked | 2014-10-16 to 2032-10-16 | 1.3.6.1.4.1.271.2.3.1.1.2 | 0 | - | clean |

## Certificate Details

### Sonera Class1 CA

- Subject: countryName=FI, organizationName=Sonera, commonName=Sonera Class1 CA
- Issuer: countryName=FI, organizationName=Sonera, commonName=Sonera Class1 CA
- Serial: 24
- SHA-256: CD808284CF746FF2FD6EB58AA1D59C4AD4B3CA56FDC6274A8926A7835F32313D
- SPKI SHA-256: AA1C2BEDB1A508BAAD7FB3F5E02897B907C748DEA9B7908904AADBD0497AAB6A
- Validity: 2001-04-06 to 2021-04-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: http://repository.trust.teliasonera.com/CPS/index3.html
- CP/CPS same as parent: false
- Audit URLs: https://cert.webtrust.org/SealFile?seal=2061&file=pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Removed","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 36 (0x24)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = FI, O = Sonera, CN = Sonera Class1 CA
        Validity
            Not Before: Apr  6 10:49:13 2001 GMT
            Not After : Apr  6 10:49:13 2021 GMT
        Subject: C = FI, O = Sonera, CN = Sonera Class1 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                47:E2:0C:8B:F6:53:88:52
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CD808284CF746FF2FD6EB58AA1D59C4AD4B3CA56FDC6274A8926A7835F32313D
    SPKI SHA256: AA1C2BEDB1A508BAAD7FB3F5E02897B907C748DEA9B7908904AADBD0497AAB6A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_root_ca_key_usage_must_be_critical: 
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- is_expired

### Sonera Class2 CA

- Subject: countryName=FI, organizationName=Sonera, commonName=Sonera Class2 CA
- Issuer: countryName=FI, organizationName=Sonera, commonName=Sonera Class2 CA
- Serial: 1D
- SHA-256: 7908B40314C138100B518D0735807FFBFCF8518A0095337105BA386B153DD927
- SPKI SHA-256: D2A5F32F0E01B910EF4E3B46BF84E5AF5FB5689E7D1507E929E368AC88C6CC76
- Validity: 2001-04-06 to 2021-04-06
- Key: RSA 2048
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ab7b3bcf-077f-4b23-9ad6-2859bdac0677, https://bugzilla.mozilla.org/attachment.cgi?id=9283224
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Disabled","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: -
- Currently valid: -
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 29 (0x1d)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = FI, O = Sonera, CN = Sonera Class2 CA
        Validity
            Not Before: Apr  6 07:29:40 2001 GMT
            Not After : Apr  6 07:29:40 2021 GMT
        Subject: C = FI, O = Sonera, CN = Sonera Class2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                4A:A0:AA:58:84:D3:5E:3C
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 7908B40314C138100B518D0735807FFBFCF8518A0095337105BA386B153DD927
    SPKI SHA256: D2A5F32F0E01B910EF4E3B46BF84E5AF5FB5689E7D1507E929E368AC88C6CC76
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_root_ca_key_usage_must_be_critical: 
- [historical] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage
- is_expired

### Telia EC Client Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Client Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Client Root CA v3
- Serial: 018BD28FB42C290A1EDAC287697BDC
- SHA-256: CCF6A7C3881928CFB1DBEBD74EABA50D3BC69633C106274D2C221ECCEE697E87
- SPKI SHA-256: 43583C1781B05919277EAE6452635985B8E50A6722210CBE817BC8FA64815A5D
- Validity: 2023-11-15 to 2048-05-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecclientrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:8f:b4:2c:29:0a:1e:da:c2:87:69:7b:dc
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SE, O = Telia Company AB, CN = Telia EC Client Root CA v3
        Validity
            Not Before: Nov 15 10:45:40 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC Client Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                04:17:A4:26:EA:F1:47:15:AB:5C:64:14:DE:D5:05:67:A0:06:C4:09
            X509v3 Subject Key Identifier:
                04:17:A4:26:EA:F1:47:15:AB:5C:64:14:DE:D5:05:67:A0:06:C4:09
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CCF6A7C3881928CFB1DBEBD74EABA50D3BC69633C106274D2C221ECCEE697E87
    SPKI SHA256: 43583C1781B05919277EAE6452635985B8E50A6722210CBE817BC8FA64815A5D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia EC Email Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Email Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Email Root CA v3
- Serial: 018BD2E10C1ED80D940387051100A6
- SHA-256: 3682228D7D678B571440CF1CB34E69FB4135FD6C2A1BE38E14163B711E02AE01
- SPKI SHA-256: F62BA89703BA4E9437277A5CBB94E5FC113D478D81DC6CF9CD5DA8B51D248AC8
- Validity: 2023-11-15 to 2048-05-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/SMIMEv12/teliacasmimecpcps.html
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-9_AAL_SMIME-BR_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecemailrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:e1:0c:1e:d8:0d:94:03:87:05:11:00:a6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SE, O = Telia Company AB, CN = Telia EC Email Root CA v3
        Validity
            Not Before: Nov 15 12:14:14 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC Email Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                2E:D1:D1:1F:4F:A9:26:AD:A6:AD:21:98:45:FB:13:1C:53:02:AF:E6
            X509v3 Subject Key Identifier:
                2E:D1:D1:1F:4F:A9:26:AD:A6:AD:21:98:45:FB:13:1C:53:02:AF:E6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3682228D7D678B571440CF1CB34E69FB4135FD6C2A1BE38E14163B711E02AE01
    SPKI SHA256: F62BA89703BA4E9437277A5CBB94E5FC113D478D81DC6CF9CD5DA8B51D248AC8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia EC Signing Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Signing Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Signing Root CA v3
- Serial: 018BD2BD19BBD6D791D880EDF9DFF9
- SHA-256: 2C4E9B0F8D0FCDC308C077E30DD2349DAF871FB3A37214859C486189A9F80ADB
- SPKI SHA-256: A5087E852D9A0F26EE0A83F440F66D2F5F77D2EC66DAD4ABD0577C3D3C6ECF5B
- Validity: 2023-11-15 to 2048-05-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecsigningrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:bd:19:bb:d6:d7:91:d8:80:ed:f9:df:f9
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SE, O = Telia Company AB, CN = Telia EC Signing Root CA v3
        Validity
            Not Before: Nov 15 11:35:09 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC Signing Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                4B:F8:88:86:2C:55:7F:A0:58:30:C5:A9:4D:0B:4D:35:D2:33:58:3C
            X509v3 Subject Key Identifier:
                4B:F8:88:86:2C:55:7F:A0:58:30:C5:A9:4D:0B:4D:35:D2:33:58:3C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2C4E9B0F8D0FCDC308C077E30DD2349DAF871FB3A37214859C486189A9F80ADB
    SPKI SHA256: A5087E852D9A0F26EE0A83F440F66D2F5F77D2EC66DAD4ABD0577C3D3C6ECF5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia EC TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Serial: 018BD22254634D048B6CE5471FD2B5
- SHA-256: 098E08A91DBBF77478B96CCEB89B1413A5DA37B7C862606A955DEB07179F4326
- SPKI SHA-256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
- Validity: 2023-11-15 to 2048-05-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/TLSv67/teliacatlscpcps.html
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-8_AAL_TLS-BR_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:22:54:63:4d:04:8b:6c:e5:47:1f:d2:b5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Validity
            Not Before: Nov 15 08:55:26 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Subject Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 098E08A91DBBF77478B96CCEB89B1413A5DA37B7C862606A955DEB07179F4326
    SPKI SHA256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia RSA Client Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3
- Serial: 018BD279F5AA2A2EE4275FA423A131
- SHA-256: 6485F6E060934AF413EC54B9C65F87BD231929ECFA11DE522BAD8DC64F001571
- SPKI SHA-256: DD61C198B1B3E2960D3E2F57C2F650B5AFA9C8358BD98B5D117809E026B3302F
- Validity: 2023-11-15 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:79:f5:aa:2a:2e:e4:27:5f:a4:23:a1:31
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Client Root CA v3
        Validity
            Not Before: Nov 15 10:21:33 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Client Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                AF:41:2F:03:2D:AA:C3:08:10:42:42:D8:DF:1E:84:64:E1:28:53:3D
            X509v3 Subject Key Identifier:
                AF:41:2F:03:2D:AA:C3:08:10:42:42:D8:DF:1E:84:64:E1:28:53:3D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6485F6E060934AF413EC54B9C65F87BD231929ECFA11DE522BAD8DC64F001571
    SPKI SHA256: DD61C198B1B3E2960D3E2F57C2F650B5AFA9C8358BD98B5D117809E026B3302F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia RSA Email Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3
- Serial: 018BD2CEF4C1157829624D79B2755B
- SHA-256: 5B0C502A7D963BA55217396FDA9B3DC78171000AEEFF42CECC3A20A7938163E8
- SPKI SHA-256: 4F73C93162FCCFDA5F07BA556AB97F73F2781ACCECA13CC18BBB899BD6F881D7
- Validity: 2023-11-15 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/SMIMEv12/teliacasmimecpcps.html
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-9_AAL_SMIME-BR_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:ce:f4:c1:15:78:29:62:4d:79:b2:75:5b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Email Root CA v3
        Validity
            Not Before: Nov 15 11:55:02 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Email Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                87:B9:06:3F:46:C5:29:14:CD:14:5E:C5:9E:23:90:B6:24:AE:66:99
            X509v3 Subject Key Identifier:
                87:B9:06:3F:46:C5:29:14:CD:14:5E:C5:9E:23:90:B6:24:AE:66:99
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5B0C502A7D963BA55217396FDA9B3DC78171000AEEFF42CECC3A20A7938163E8
    SPKI SHA256: 4F73C93162FCCFDA5F07BA556AB97F73F2781ACCECA13CC18BBB899BD6F881D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia RSA Signing Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Signing Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Signing Root CA v3
- Serial: 018BD2A8B4E46D22D52EEF0E77E292
- SHA-256: C2FB44D8DEF85126D84FC41FBE667BC811F0D633411CAC26D13FBD95EA5BE603
- SPKI SHA-256: 2F3C2359C650387B1FD12F6AF6485D8101B4D718781AF15BB7DAE54BB92D1AF7
- Validity: 2023-11-15 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsasigningrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:a8:b4:e4:6d:22:d5:2e:ef:0e:77:e2:92
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Signing Root CA v3
        Validity
            Not Before: Nov 15 11:12:55 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Signing Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                04:7D:A3:E1:33:9F:C9:8A:FB:42:B0:56:C1:14:B9:53:86:35:72:12
            X509v3 Subject Key Identifier:
                04:7D:A3:E1:33:9F:C9:8A:FB:42:B0:56:C1:14:B9:53:86:35:72:12
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C2FB44D8DEF85126D84FC41FBE667BC811F0D633411CAC26D13FBD95EA5BE603
    SPKI SHA256: 2F3C2359C650387B1FD12F6AF6485D8101B4D718781AF15BB7DAE54BB92D1AF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Telia RSA TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Serial: 018BD250AB42552C475ABDA1DC1AC5
- SHA-256: D13DB1294C45EBC6FC86C6BBF69FA29BDFE692DFF7C713C243C7A956C6A2284C
- SPKI SHA-256: 536CFDAE8A6257BF14266C43285958D0F9B937E3068E2A215374170133A9FFCC
- Validity: 2023-11-15 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/TLSv67/teliacatlscpcps.html
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-8_AAL_TLS-BR_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:50:ab:42:55:2c:47:5a:bd:a1:dc:1a:c5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Validity
            Not Before: Nov 15 09:47:42 2023 GMT
            Not After : May 23 11:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Subject Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D13DB1294C45EBC6FC86C6BBF69FA29BDFE692DFF7C713C243C7A956C6A2284C
    SPKI SHA256: 536CFDAE8A6257BF14266C43285958D0F9B937E3068E2A215374170133A9FFCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TeliaSonera Root CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 95BE16A0F72E46F17B398272FA8BCD96
- SHA-256: DD6936FE21F8F077C123A1A521C12224F72255B73E03A7260693E8A24B0FA389
- SPKI SHA-256: 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B
- Validity: 2007-10-18 to 2032-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://cps.trust.telia.com/TLSv67/teliacatlscpcps.html; https://cps.trust.telia.com/Telia_Client_Certificate_CPS_v5.1.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-7_AAL_Standard_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-8_AAL_TLS-BR_Audit_Telia_V1.pdf, https://www.datenschutz-cert.de/fileadmin/uploads/tx_dscertcertlist/DSC1257-9_AAL_SMIME-BR_Audit_Telia_V1.pdf
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Removed","microsoft":"Included","mozilla":"Removed"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            95:be:16:a0:f7:2e:46:f1:7b:39:82:72:fa:8b:cd:96
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 18 12:00:50 2007 GMT
            Not After : Oct 18 12:00:50 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage:
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: DD6936FE21F8F077C123A1A521C12224F72255B73E03A7260693E8A24B0FA389
    SPKI SHA256: 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_root_ca_key_usage_must_be_critical: 
- [current] warn w_ext_key_usage_not_critical: 

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### Ericsson NL Individual CA v2

- Subject: organizationName=Ericsson, commonName=Ericsson NL Individual CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: A00CCBCC9B9998ECE23A70F47CC1C059
- SHA-256: 24D06B967E70BC8CE21FFCAFD3EB5B69A4E2E2CBAF36BB9CD64EABCDD1423C4E
- SPKI SHA-256: C3E0FA67ED7D90A04DE5D878B09BFB72612D33FDFC0FF64ACA8983539EABE86B
- Validity: 2014-05-27 to 2024-05-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a0:0c:cb:cc:9b:99:98:ec:e2:3a:70:f4:7c:c1:c0:59
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 27 07:46:21 2014 GMT
            Not After : May 27 07:46:21 2024 GMT
        Subject: O = Ericsson, CN = Ericsson NL Individual CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                B1:0D:CA:D4:46:B7:AF:86:02:C3:2F:6F:06:CA:0E:76:71:7F:4B:37
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 24D06B967E70BC8CE21FFCAFD3EB5B69A4E2E2CBAF36BB9CD64EABCDD1423C4E
    SPKI SHA256: C3E0FA67ED7D90A04DE5D878B09BFB72612D33FDFC0FF64ACA8983539EABE86B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ericsson NL Individual CA v3

- Subject: countryName=SE, organizationName=Ericsson, commonName=Ericsson NL Individual CA v3
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 53B87E83E19C992893B09B491CECB8EB
- SHA-256: 63ED95B17FFDCB7AE30FEAC6A874653099264E21B268D836D957966F0B04BE43
- SPKI SHA-256: 81DC3325873FA662B58D181B695A3E0AD4FD405E17E84D427122BFE63F821E77
- Validity: 2015-10-27 to 2025-10-27
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.trust.telia.com/ericssonnlindividualcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            53:b8:7e:83:e1:9c:99:28:93:b0:9b:49:1c:ec:b8:eb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 27 12:16:46 2015 GMT
            Not After : Oct 27 12:16:46 2025 GMT
        Subject: C = SE, O = Ericsson, CN = Ericsson NL Individual CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                1C:7B:19:9E:97:9C:76:AC:20:3D:D8:DC:E3:91:6A:E3:DB:2D:A6:53
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 63ED95B17FFDCB7AE30FEAC6A874653099264E21B268D836D957966F0B04BE43
    SPKI SHA256: 81DC3325873FA662B58D181B695A3E0AD4FD405E17E84D427122BFE63F821E77
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
- is_expired

### Ericsson NL Individual CA v4

- Subject: countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v4
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0180D0E714930D3733464C8DFA2E56
- SHA-256: 800707B1F57FCDF95CFB047B387C6F48142DA885B7DC1FED28C5F87F0C712AD4
- SPKI SHA-256: ABD275A07B9F399B2A3DB58D409328ABC0C60760A7E8806CFE482E9351E40057
- Validity: 2022-05-17 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/ericssonnlindividualcav4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.18
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:80:d0:e7:14:93:0d:37:33:46:4c:8d:fa:2e:56
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: May 17 07:22:45 2022 GMT
            Not After : Nov 29 07:22:45 2043 GMT
        Subject: C = SE, O = Ericsson AB, CN = Ericsson NL Individual CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                19:C1:FF:10:09:FC:FD:40:DD:36:B0:6E:D9:8D:6F:3F:B7:ED:9C:2B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.18
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints: critical
                Permitted:
                  email:ericsson.com
                  email:.ericsson.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 800707B1F57FCDF95CFB047B387C6F48142DA885B7DC1FED28C5F87F0C712AD4
    SPKI SHA256: ABD275A07B9F399B2A3DB58D409328ABC0C60760A7E8806CFE482E9351E40057
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.18
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Ericsson NL Individual CA v4

- Subject: countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v4
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0189FD5350B24F2F5849BE2A91A4C3
- SHA-256: EE0343093DF71E364606100164C62A4FB8C4A0F32B1EB47860FFD6C17E94CA54
- SPKI SHA-256: ABD275A07B9F399B2A3DB58D409328ABC0C60760A7E8806CFE482E9351E40057
- Validity: 2023-08-16 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/ericssonnlindividualcav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.18, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:53:50:b2:4f:2f:58:49:be:2a:91:a4:c3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Aug 16 07:47:45 2023 GMT
            Not After : Nov 29 07:22:45 2043 GMT
        Subject: C = SE, O = Ericsson AB, CN = Ericsson NL Individual CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                19:C1:FF:10:09:FC:FD:40:DD:36:B0:6E:D9:8D:6F:3F:B7:ED:9C:2B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.18
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.3.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints: critical
                Permitted:
                  email:ericsson.com
                  email:.ericsson.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EE0343093DF71E364606100164C62A4FB8C4A0F32B1EB47860FFD6C17E94CA54
    SPKI SHA256: ABD275A07B9F399B2A3DB58D409328ABC0C60760A7E8806CFE482E9351E40057
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.18, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Ericsson NL Individual CA v5

- Subject: countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v5
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3
- Serial: 018E75073B609A3787E91B37806979
- SHA-256: B974D221C073DF439FE2918845D9783D7E4762C5A9D777DF2DECCBDBDCC1C1CC
- SPKI SHA-256: 1359B25E42D133ADF81B297071C35B46451EB35E5B043150A440340B3319620E
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/ericssonnlindividualcav5.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.271.2.3.1.1.18
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:75:07:3b:60:9a:37:87:e9:1b:37:80:69:79
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Email Root CA v3
        Validity
            Not Before: Mar 25 09:52:04 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Ericsson AB, CN = Ericsson NL Individual CA v5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                87:B9:06:3F:46:C5:29:14:CD:14:5E:C5:9E:23:90:B6:24:AE:66:99
            X509v3 Subject Key Identifier:
                9F:31:E7:AE:34:1F:1A:6E:12:4B:7E:8E:CC:26:08:AD:1A:AA:F1:5E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.271.2.3.1.1.18
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints: critical
                Permitted:
                  email:ericsson.com
                  email:.ericsson.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsaemailrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B974D221C073DF439FE2918845D9783D7E4762C5A9D777DF2DECCBDBDCC1C1CC
    SPKI SHA256: 1359B25E42D133ADF81B297071C35B46451EB35E5B043150A440340B3319620E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.271.2.3.1.1.18
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsaemailrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Ericsson NL Individual CA v5

- Subject: countryName=SE, organizationName=Ericsson AB, commonName=Ericsson NL Individual CA v5
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3
- Serial: 0197774F143F440BB3DBF2EFDDA24D
- SHA-256: 6A1ADE9A5BB8AE0782A2325AF163B2D2305413403734D5DE59977ACA7D3D4882
- SPKI SHA-256: 1359B25E42D133ADF81B297071C35B46451EB35E5B043150A440340B3319620E
- Validity: 2025-06-16 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/ericssonnlindividualcav5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.271.2.3.1.1.18
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:97:77:4f:14:3f:44:0b:b3:db:f2:ef:dd:a2:4d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Email Root CA v3
        Validity
            Not Before: Jun 16 05:46:28 2025 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Ericsson AB, CN = Ericsson NL Individual CA v5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                87:B9:06:3F:46:C5:29:14:CD:14:5E:C5:9E:23:90:B6:24:AE:66:99
            X509v3 Subject Key Identifier:
                9F:31:E7:AE:34:1F:1A:6E:12:4B:7E:8E:CC:26:08:AD:1A:AA:F1:5E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.5.1.2
                Policy: 2.23.140.1.5.1.3
                Policy: 2.23.140.1.5.2.2
                Policy: 2.23.140.1.5.2.3
                Policy: 2.23.140.1.5.3.2
                Policy: 2.23.140.1.5.3.3
                Policy: 1.3.6.1.4.1.271.2.3.1.1.18
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Name Constraints: critical
                Permitted:
                  email:ericsson.com
                  email:.ericsson.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarsaemailrootcav3.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6A1ADE9A5BB8AE0782A2325AF163B2D2305413403734D5DE59977ACA7D3D4882
    SPKI SHA256: 1359B25E42D133ADF81B297071C35B46451EB35E5B043150A440340B3319620E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.23.140.1.5.1.2, 2.23.140.1.5.1.3, 2.23.140.1.5.2.2, 2.23.140.1.5.2.3, 2.23.140.1.5.3.2, 2.23.140.1.5.3.3, 1.3.6.1.4.1.271.2.3.1.1.18
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsaemailrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Name Constraints: {"present":true,"critical":true,"permitted":["email:ericsson.com","email:.ericsson.com"],"excluded":[]}

#### zlint Findings


- [current] error e_mailbox_validated_allowed_subjectdn_attributes: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_name_constraints
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 1 CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Class 1 CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 017983CF18222C81AEC7429A0897A2
- SHA-256: 2E459B4B2F4C24D3BCF6D357E21DC74286C889104888267E2BACA75C78D1A615
- SPKI SHA-256: DCD5FC52F50F3BD8B079AF5F7F8E54BA429F5A9C9BF59AF568064BA263D1508E
- Validity: 2021-05-19 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass1cav3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.11
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:79:83:cf:18:22:2c:81:ae:c7:42:9a:08:97:a2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: May 19 08:46:06 2021 GMT
            Not After : Nov 28 08:46:06 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Class 1 CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                4F:E9:D5:31:F5:D5:30:E8:59:87:48:0D:A6:14:67:44:A9:59:DC:D4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.11
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 2E459B4B2F4C24D3BCF6D357E21DC74286C889104888267E2BACA75C78D1A615
    SPKI SHA256: DCD5FC52F50F3BD8B079AF5F7F8E54BA429F5A9C9BF59AF568064BA263D1508E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.11
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 1 CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Class 1 CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0189FD3E508DA45D8D3E2331820355
- SHA-256: E85BA26F89FEB670A2638E1E293054DE1A955DD1909A0AFD508B1F87F06104A9
- SPKI SHA-256: DCD5FC52F50F3BD8B079AF5F7F8E54BA429F5A9C9BF59AF568064BA263D1508E
- Validity: 2023-08-16 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass1cav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.11, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:3e:50:8d:a4:5d:8d:3e:23:31:82:03:55
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Aug 16 07:25:00 2023 GMT
            Not After : Nov 28 08:46:06 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Class 1 CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                4F:E9:D5:31:F5:D5:30:E8:59:87:48:0D:A6:14:67:44:A9:59:DC:D4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.11
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.3.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E85BA26F89FEB670A2638E1E293054DE1A955DD1909A0AFD508B1F87F06104A9
    SPKI SHA256: DCD5FC52F50F3BD8B079AF5F7F8E54BA429F5A9C9BF59AF568064BA263D1508E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.11, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 2 CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 2 CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 017983DE6DEEA11B973B5A468FFE58
- SHA-256: E5F6844EABECA374B597295671CD12C37D7CDBBFE75529C4D61E5BA2BD32BB11
- SPKI SHA-256: 45B51BD93530619EE5E3A864D1107F30B89525833871D956E0D402E87AD2D4DE
- Validity: 2021-05-19 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass2cav3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:79:83:de:6d:ee:a1:1b:97:3b:5a:46:8f:fe:58
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: May 19 09:03:30 2021 GMT
            Not After : Nov 28 09:03:30 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Class 2 CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                D3:A4:B5:F8:3E:59:CD:8C:11:E0:1A:34:76:34:93:DD:7E:9D:4D:F9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.12
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E5F6844EABECA374B597295671CD12C37D7CDBBFE75529C4D61E5BA2BD32BB11
    SPKI SHA256: 45B51BD93530619EE5E3A864D1107F30B89525833871D956E0D402E87AD2D4DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.12
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 2 CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 2 CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0189FD467925ADD3FD97888428DF3D
- SHA-256: 96FD4A9ED8E28B901D5E93E265992A9D411D49DC2280B5CF89398A862B7E26EC
- SPKI SHA-256: 45B51BD93530619EE5E3A864D1107F30B89525833871D956E0D402E87AD2D4DE
- Validity: 2023-08-16 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass2cav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.12, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:46:79:25:ad:d3:fd:97:88:84:28:df:3d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Aug 16 07:32:30 2023 GMT
            Not After : Nov 28 09:03:30 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Class 2 CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                D3:A4:B5:F8:3E:59:CD:8C:11:E0:1A:34:76:34:93:DD:7E:9D:4D:F9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.12
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.3.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 96FD4A9ED8E28B901D5E93E265992A9D411D49DC2280B5CF89398A862B7E26EC
    SPKI SHA256: 45B51BD93530619EE5E3A864D1107F30B89525833871D956E0D402E87AD2D4DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.12, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 3 CA v1

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 3 CA v1
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0175BBB1DD52F06C82A8585FB18D24
- SHA-256: E7340DC9475E87C4E5A4572C82604C5EFF9BF60B231C5486943173B26A4CAFCC
- SPKI SHA-256: 06E3BDDF11C9A63B0DC988CF002CB143D4A549EBCABF0A1591E2F9AB9C5B9C82
- Validity: 2020-11-12 to 2043-11-25
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass3cav1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.13
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:75:bb:b1:dd:52:f0:6c:82:a8:58:5f:b1:8d:24
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 12 08:58:16 2020 GMT
            Not After : Nov 25 08:58:16 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Class 3 CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                19:BE:61:8A:5F:34:BF:FF:91:87:B7:5F:DE:D5:25:63:09:0B:50:C4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.13
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E7340DC9475E87C4E5A4572C82604C5EFF9BF60B231C5486943173B26A4CAFCC
    SPKI SHA256: 06E3BDDF11C9A63B0DC988CF002CB143D4A549EBCABF0A1591E2F9AB9C5B9C82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.13
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 3 CA v2

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 3 CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 018B700FB21E9C0A861996973BBE0A
- SHA-256: 5E343F2432BBF0ECC7062F4237110581DFFD638CC3689D50D5864174C9DC011D
- SPKI SHA-256: 06E3BDDF11C9A63B0DC988CF002CB143D4A549EBCABF0A1591E2F9AB9C5B9C82
- Validity: 2023-10-27 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass3cav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:70:0f:b2:1e:9c:0a:86:19:96:97:3b:be:0a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 27 07:30:15 2023 GMT
            Not After : Oct 17 09:00:00 2032 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Class 3 CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                19:BE:61:8A:5F:34:BF:FF:91:87:B7:5F:DE:D5:25:63:09:0B:50:C4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5E343F2432BBF0ECC7062F4237110581DFFD638CC3689D50D5864174C9DC011D
    SPKI SHA256: 06E3BDDF11C9A63B0DC988CF002CB143D4A549EBCABF0A1591E2F9AB9C5B9C82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Class 3 CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Class 3 CA v3
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 018EEB0C8EF897CECE2A14F4F84BB7
- SHA-256: D20E08A8F9E16DF94A4CD7E052B382C339880B47931B78CC7DF404C063E49852
- SPKI SHA-256: F307DA6FAC150CEBE76FBE609495AECE5A8042B1D2F9C94EBA8FBC522B1CBD95
- Validity: 2024-04-17 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaclass3cav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:eb:0c:8e:f8:97:ce:ce:2a:14:f4:f8:4b:b7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Apr 17 07:49:53 2024 GMT
            Not After : Oct 17 10:00:00 2032 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Class 3 CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                B4:F1:84:E7:62:EA:0D:AB:12:22:94:ED:3B:84:2E:B1:89:22:AC:CE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D20E08A8F9E16DF94A4CD7E052B382C339880B47931B78CC7DF404C063E49852
    SPKI SHA256: F307DA6FAC150CEBE76FBE609495AECE5A8042B1D2F9C94EBA8FBC522B1CBD95
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Document Signing CA v1

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 01604B22F6763F0901EE04836B973C
- SHA-256: 41931F94B1662FCA06A992E9E02793EF51E97016C7741D4647E8A9FA7746346C
- SPKI SHA-256: B6AB2C3E799E216F01868F8027A85FA3C803FFECBC01E29F814854D438CD0EAB
- Validity: 2017-11-28 to 2032-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:60:4b:22:f6:76:3f:09:01:ee:04:83:6b:97:3c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Nov 28 12:37:28 2017 GMT
            Not After : Oct 18 12:00:50 2032 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Document Signing CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                EE:2A:A3:20:42:D6:99:4E:4E:3D:1E:9E:4F:E0:B8:A9:9D:74:DB:FA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 41931F94B1662FCA06A992E9E02793EF51E97016C7741D4647E8A9FA7746346C
    SPKI SHA256: B6AB2C3E799E216F01868F8027A85FA3C803FFECBC01E29F814854D438CD0EAB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Document Signing CA v2

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 016584C9E92B8033F586F03C5CA0DC
- SHA-256: DF189638D127977DBBE49219F1486B47C2606EA2A2CBC460F57EBE7177809681
- SPKI SHA-256: 6DF33CFE6E3A1110F6B38F90812DD12471602760E939E02BAD9E19042B820019
- Validity: 2018-08-29 to 2032-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:65:84:c9:e9:2b:80:33:f5:86:f0:3c:5c:a0:dc
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Aug 29 08:24:02 2018 GMT
            Not After : Oct 18 12:00:50 2032 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Document Signing CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                66:11:B9:3B:F8:26:80:F4:34:CE:87:8E:9B:1F:04:88:76:94:59:B2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.20
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: DF189638D127977DBBE49219F1486B47C2606EA2A2CBC460F57EBE7177809681
    SPKI SHA256: 6DF33CFE6E3A1110F6B38F90812DD12471602760E939E02BAD9E19042B820019
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.20
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Document Signing CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 016D05B10DE8D1D0E3F660560A6A9B
- SHA-256: B721E745DA10E6825E107F55FBAE4D923601E747A9830ED956CD2886CA15A8F8
- SPKI SHA-256: F981E22A4360ABEC2D639B83539EF10EB4CF59B32BD335DAA36A3DCADEC8DD75
- Validity: 2019-09-06 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:6d:05:b1:0d:e8:d1:d0:e3:f6:60:56:0a:6a:9b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Sep  6 08:26:39 2019 GMT
            Not After : Nov 29 11:55:54 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Document Signing CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                36:17:10:8E:9E:86:9F:26:7F:D5:75:42:FA:D3:7B:C2:90:59:DE:54
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.20
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B721E745DA10E6825E107F55FBAE4D923601E747A9830ED956CD2886CA15A8F8
    SPKI SHA256: F981E22A4360ABEC2D639B83539EF10EB4CF59B32BD335DAA36A3DCADEC8DD75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.20
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Document Signing CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Document Signing CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 016D1A4D94951BA3294A0C26D06250
- SHA-256: 6924A4DD82948DA53F6FB933E895A0F6581C8DBDEBABB36FC11CAC25E9C0335A
- SPKI SHA-256: F981E22A4360ABEC2D639B83539EF10EB4CF59B32BD335DAA36A3DCADEC8DD75
- Validity: 2019-09-10 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliadocumentsigningcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:6d:1a:4d:94:95:1b:a3:29:4a:0c:26:d0:62:50
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Sep 10 08:30:41 2019 GMT
            Not After : Nov 29 11:55:54 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Document Signing CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                36:17:10:8E:9E:86:9F:26:7F:D5:75:42:FA:D3:7B:C2:90:59:DE:54
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.20
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6924A4DD82948DA53F6FB933E895A0F6581C8DBDEBABB36FC11CAC25E9C0335A
    SPKI SHA256: F981E22A4360ABEC2D639B83539EF10EB4CF59B32BD335DAA36A3DCADEC8DD75
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.20
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Domain Validation CA v2

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Domain Validation CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 016584E34A38D9E963EBEED2174784
- SHA-256: 5B312B7E11B70D07C14E0AB99F08D00748966098C52AA85A06A0822BBE59A02C
- SPKI SHA-256: 801E250EAB39BB0E8A8F1C1E2E03AA59FC4D9277098450A0EEB0778442787EFA
- Validity: 2018-08-29 to 2032-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliadomainvalidationcav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:65:84:e3:4a:38:d9:e9:63:eb:ee:d2:17:47:84
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Aug 29 08:51:40 2018 GMT
            Not After : Oct 18 12:00:50 2032 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Domain Validation CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                ED:3D:74:9C:2C:53:BB:71:93:7B:4B:11:F6:B8:91:E2:82:F9:92:DB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5B312B7E11B70D07C14E0AB99F08D00748966098C52AA85A06A0822BBE59A02C
    SPKI SHA256: 801E250EAB39BB0E8A8F1C1E2E03AA59FC4D9277098450A0EEB0778442787EFA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Domain Validation CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Domain Validation CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 01675FFDE7E41811E2CD76B0CDB50A
- SHA-256: A7E83056E9B3D9DDB1816B95518F6A5E5A1DFDFA28F60533B1C850855EAA4263
- SPKI SHA-256: 454DA321F333B63E00003821CA08D8F606F15245B5DCB5D1492EC978E360AF17
- Validity: 2018-11-29 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliadomainvalidationcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:67:5f:fd:e7:e4:18:11:e2:cd:76:b0:cd:b5:0a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 29 14:59:22 2018 GMT
            Not After : Nov 29 11:55:54 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Domain Validation CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                5B:F1:EE:29:8D:31:B2:3B:3A:E0:17:CB:A4:07:E9:3F:82:42:1F:A3
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A7E83056E9B3D9DDB1816B95518F6A5E5A1DFDFA28F60533B1C850855EAA4263
    SPKI SHA256: 454DA321F333B63E00003821CA08D8F606F15245B5DCB5D1492EC978E360AF17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Domain Validation SSL CA v1

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Domain Validation SSL CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 0161AE2005CE3F127EF88DD7251BB1
- SHA-256: D75F8BC0DB4B29382145499A61148659CF29A967E2AE470B498A1799788A8284
- SPKI SHA-256: 5BB396F5D16ECE2DBF2308C28D1CD1591A58FEF5EB8756E5753601C05D2568D2
- Validity: 2018-02-19 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:61:ae:20:05:ce:3f:12:7e:f8:8d:d7:25:1b:b1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Feb 19 12:52:30 2018 GMT
            Not After : Oct 16 11:32:30 2032 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Domain Validation SSL CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                49:6C:32:53:7C:5D:ED:2B:E3:A2:AB:9C:0B:C9:5D:E4:95:D4:92:5F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            Authority Information Access:
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D75F8BC0DB4B29382145499A61148659CF29A967E2AE470B498A1799788A8284
    SPKI SHA256: 5BB396F5D16ECE2DBF2308C28D1CD1591A58FEF5EB8756E5753601C05D2568D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Domain Validation SSL CA v1

- Subject: countryName=FI, organizationName=Telia, commonName=Telia Domain Validation SSL CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 015FC49AC4705CF0D90535E3CF4491
- SHA-256: 5F20CD1B0F7A827DD61B29F390970AAD96F0428219DE9B504A170B56AB68CF8D
- SPKI SHA-256: 5BB396F5D16ECE2DBF2308C28D1CD1591A58FEF5EB8756E5753601C05D2568D2
- Validity: 2017-11-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:5f:c4:9a:c4:70:5c:f0:d9:05:35:e3:cf:44:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Nov 16 11:32:30 2017 GMT
            Not After : Oct 16 11:32:30 2032 GMT
        Subject: C = FI, O = Telia, CN = Telia Domain Validation SSL CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                49:6C:32:53:7C:5D:ED:2B:E3:A2:AB:9C:0B:C9:5D:E4:95:D4:92:5F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 5F20CD1B0F7A827DD61B29F390970AAD96F0428219DE9B504A170B56AB68CF8D
    SPKI SHA256: 5BB396F5D16ECE2DBF2308C28D1CD1591A58FEF5EB8756E5753601C05D2568D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC Client Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Client Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD36703597DDEB6D6416552CCA0
- SHA-256: 708E7E73BC638B90F14BAAB634B5CBFBF8FFE1BD1B24B1744612E49167CA7731
- SPKI SHA-256: 43583C1781B05919277EAE6452635985B8E50A6722210CBE817BC8FA64815A5D
- Validity: 2023-11-15 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecclientrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:67:03:59:7d:de:b6:d6:41:65:52:cc:a0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 14:32:27 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC Client Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                04:17:A4:26:EA:F1:47:15:AB:5C:64:14:DE:D5:05:67:A0:06:C4:09
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 708E7E73BC638B90F14BAAB634B5CBFBF8FFE1BD1B24B1744612E49167CA7731
    SPKI SHA256: 43583C1781B05919277EAE6452635985B8E50A6722210CBE817BC8FA64815A5D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC DV CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC DV CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Serial: 018E7478A40E276F120C40D9C27A98
- SHA-256: 26D742741BA428394F904E4410ED6DA92F4D0C55521F1EDE2B29797F866C955C
- SPKI SHA-256: 35E37B21BCA1FC4165BA8644DBB39F3520CBA55B2ACC23AD4887B4603CF61920
- Validity: 2024-03-25 to 2048-05-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:78:a4:0e:27:6f:12:0c:40:d9:c2:7a:98
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Validity
            Not Before: Mar 25 07:15:28 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC DV CA v4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Subject Key Identifier:
                FC:4D:33:98:CA:4D:E4:B9:36:24:9F:DF:59:6E:C0:2D:D1:3D:AB:23
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliaectlsrootcav3.cer
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 26D742741BA428394F904E4410ED6DA92F4D0C55521F1EDE2B29797F866C955C
    SPKI SHA256: 35E37B21BCA1FC4165BA8644DBB39F3520CBA55B2ACC23AD4887B4603CF61920
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliaectlsrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC DV CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC DV CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Serial: 0193DE2A9E7797D158CBDF0BA23730
- SHA-256: 69E4AA2C42958ADABC4B171A41C2D9E7B2EB7C91772FBD4B5EFB1C845CD52FAF
- SPKI SHA-256: 35E37B21BCA1FC4165BA8644DBB39F3520CBA55B2ACC23AD4887B4603CF61920
- Validity: 2024-12-19 to 2048-05-23
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecdvcav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:93:de:2a:9e:77:97:d1:58:cb:df:0b:a2:37:30
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Validity
            Not Before: Dec 19 09:04:45 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC DV CA v4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Subject Key Identifier:
                FC:4D:33:98:CA:4D:E4:B9:36:24:9F:DF:59:6E:C0:2D:D1:3D:AB:23
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliaectlsrootcav3.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 69E4AA2C42958ADABC4B171A41C2D9E7B2EB7C91772FBD4B5EFB1C845CD52FAF
    SPKI SHA256: 35E37B21BCA1FC4165BA8644DBB39F3520CBA55B2ACC23AD4887B4603CF61920
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliaectlsrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC Email Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Email Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD384A17C58859D41ED974899B7
- SHA-256: 18C2FC38AFD8E668A89A6FC1E8A924C8D5C6BD1A70089FDDE56361CDA92EF445
- SPKI SHA-256: F62BA89703BA4E9437277A5CBB94E5FC113D478D81DC6CF9CD5DA8B51D248AC8
- Validity: 2023-11-15 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecemailrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:84:a1:7c:58:85:9d:41:ed:97:48:99:b7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 15:04:18 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC Email Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                2E:D1:D1:1F:4F:A9:26:AD:A6:AD:21:98:45:FB:13:1C:53:02:AF:E6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 18C2FC38AFD8E668A89A6FC1E8A924C8D5C6BD1A70089FDDE56361CDA92EF445
    SPKI SHA256: F62BA89703BA4E9437277A5CBB94E5FC113D478D81DC6CF9CD5DA8B51D248AC8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC Signing Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC Signing Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD376675BC8105E6EFF83667777
- SHA-256: 622F1C188A0E818C222E9A5674980D6E77197E580FC476C6F741DC0606FF538A
- SPKI SHA-256: A5087E852D9A0F26EE0A83F440F66D2F5F77D2EC66DAD4ABD0577C3D3C6ECF5B
- Validity: 2023-11-15 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaecsigningrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:76:67:5b:c8:10:5e:6e:ff:83:66:77:77
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 14:47:45 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC Signing Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                4B:F8:88:86:2C:55:7F:A0:58:30:C5:A9:4D:0B:4D:35:D2:33:58:3C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 622F1C188A0E818C222E9A5674980D6E77197E580FC476C6F741DC0606FF538A
    SPKI SHA256: A5087E852D9A0F26EE0A83F440F66D2F5F77D2EC66DAD4ABD0577C3D3C6ECF5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0193DDFAA744D4AE19777DB68B7337
- SHA-256: 70F84634C3246A43E9722CB1E0ABC5BB9BCA62FFFB70EB7EA73F4BB706C853C1
- SPKI SHA-256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
- Validity: 2024-12-19 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:93:dd:fa:a7:44:d4:ae:19:77:7d:b6:8b:73:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Dec 19 08:12:19 2024 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 70F84634C3246A43E9722CB1E0ABC5BB9BCA62FFFB70EB7EA73F4BB706C853C1
    SPKI SHA256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD3934723E15F565AD80C061690
- SHA-256: 07E5866107E24AE69A9679668F916AA1B3B39DC3554781E3AE9ABAA44B5A7BC4
- SPKI SHA-256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
- Validity: 2023-11-15 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaectlsrootcav3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:93:47:23:e1:5f:56:5a:d8:0c:06:16:90
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 15:20:49 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 07E5866107E24AE69A9679668F916AA1B3B39DC3554781E3AE9ABAA44B5A7BC4
    SPKI SHA256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0193DDE4008C6D82BB6C1D4878D6BE
- SHA-256: 607FD06E4C56534DC47A22565B9AE0859C61915858BF43BC42D8628212936DEA
- SPKI SHA-256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
- Validity: 2024-12-19 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:93:dd:e4:00:8c:6d:82:bb:6c:1d:48:78:d6:be
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Dec 19 07:40:55 2024 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 607FD06E4C56534DC47A22565B9AE0859C61915858BF43BC42D8628212936DEA
    SPKI SHA256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia EC TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia EC TLS Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD32269CAAAB8EE65220551E90E
- SHA-256: 9DBD8D9A36695D6A3727F2BE8FE7B4275A62A9F8DC7927A32C476F7DECE27E28
- SPKI SHA-256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
- Validity: 2023-11-15 to 2043-11-28
- Key: EC 384 secp384r1
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:22:69:ca:aa:b8:ee:65:22:05:51:e9:0e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 13:15:38 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia EC TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                D4:64:E8:43:88:3A:73:2F:D0:1A:71:82:36:0B:5E:85:DE:C7:DE:43
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9DBD8D9A36695D6A3727F2BE8FE7B4275A62A9F8DC7927A32C476F7DECE27E28
    SPKI SHA256: 4C821D7D89ADF08C1E951C92B841B4A3C18261B9CE426F337CC0E3805499BA0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Email CA v5

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Email CA v5
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0189FD4AE566C259E9B3EA65C90A71
- SHA-256: E26BA792CDF9E21B6402044DD9A61E2E1537D5FFD22EE2478979408E3233310A
- SPKI SHA-256: 64911DA2DFBABFC2E70735E8FB80FFD6216CA87B2C1235B4BE493B165E61964C
- Validity: 2023-08-16 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaemailcav5.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.14, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:4a:e5:66:c2:59:e9:b3:ea:65:c9:0a:71
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Aug 16 07:39:30 2023 GMT
            Not After : Nov 28 08:18:31 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Email CA v5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                37:E6:AF:0C:B0:E0:01:97:5B:18:BF:86:44:B8:1C:D1:E3:E1:65:94
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.14
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.3.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E26BA792CDF9E21B6402044DD9A61E2E1537D5FFD22EE2478979408E3233310A
    SPKI SHA256: 64911DA2DFBABFC2E70735E8FB80FFD6216CA87B2C1235B4BE493B165E61964C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.14, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Email CA v5

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia Email CA v5
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 017983B68835921B18B1C91E6403B3
- SHA-256: 8BB1BA521951077143A02CDB409D200B954F4684E59C67682A14852EF7B3EB44
- SPKI SHA-256: 64911DA2DFBABFC2E70735E8FB80FFD6216CA87B2C1235B4BE493B165E61964C
- Validity: 2021-05-19 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaemailcav5.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.14
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:79:83:b6:88:35:92:1b:18:b1:c9:1e:64:03:b3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: May 19 08:18:31 2021 GMT
            Not After : Nov 28 08:18:31 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia Email CA v5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                37:E6:AF:0C:B0:E0:01:97:5B:18:BF:86:44:B8:1C:D1:E3:E1:65:94
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.14
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 8BB1BA521951077143A02CDB409D200B954F4684E59C67682A14852EF7B3EB44
    SPKI SHA256: 64911DA2DFBABFC2E70735E8FB80FFD6216CA87B2C1235B4BE493B165E61964C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.14
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Extended Validation CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Extended Validation CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 01675FAC72994C74BF1A67EDC1B3AD
- SHA-256: 98C2545A2C05A342EDB22A9F6C7CCC1FE98D87595676E3A298ADE97F7B01291D
- SPKI SHA-256: 33AE065EA9894594B8F8761FCD504E37CE8573846B5A9A34B943006894864A8A
- Validity: 2018-11-29 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaextendedvalidationcav3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:67:5f:ac:72:99:4c:74:bf:1a:67:ed:c1:b3:ad
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 29 13:30:32 2018 GMT
            Not After : Nov 29 11:55:54 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Extended Validation CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                FB:36:70:3B:5D:1F:F0:7D:B2:20:89:C0:E9:2E:B7:D9:E8:58:A8:35
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 98C2545A2C05A342EDB22A9F6C7CCC1FE98D87595676E3A298ADE97F7B01291D
    SPKI SHA256: 33AE065EA9894594B8F8761FCD504E37CE8573846B5A9A34B943006894864A8A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Root CA v2

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 01675F27D6FE7AE3E4ACBE095B059E
- SHA-256: 242B69742FCB1E5B2ABF98898B94572187544E5B4D9911786573621F6A74B82C
- SPKI SHA-256: C2B3C31A4A29850AA8F3CF472A1169FF71B416579F6A4482EC7744B83DF988AC
- Validity: 2018-11-29 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:67:5f:27:d6:fe:7a:e3:e4:ac:be:09:5b:05:9e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 29 11:55:54 2018 GMT
            Not After : Nov 29 11:55:54 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 242B69742FCB1E5B2ABF98898B94572187544E5B4D9911786573621F6A74B82C
    SPKI SHA256: C2B3C31A4A29850AA8F3CF472A1169FF71B416579F6A4482EC7744B83DF988AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage

### Telia Root CA v2

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 01675F82BE0017DE8955A9376EB1F9
- SHA-256: EF6F29F636F62BDD4753122F41F3419EE7C2877587BE4A9807ADF58946458E7F
- SPKI SHA-256: C2B3C31A4A29850AA8F3CF472A1169FF71B416579F6A4482EC7744B83DF988AC
- Validity: 2018-11-29 to 2032-10-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:67:5f:82:be:00:17:de:89:55:a9:37:6e:b1:f9
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Nov 29 12:40:13 2018 GMT
            Not After : Oct 18 12:00:50 2032 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://cps.trust.telia.com
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: EF6F29F636F62BDD4753122F41F3419EE7C2877587BE4A9807ADF58946458E7F
    SPKI SHA256: C2B3C31A4A29850AA8F3CF472A1169FF71B416579F6A4482EC7744B83DF988AC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Client 1 CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client 1 CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3
- Serial: 018E74BD9F19F7C8979DB4E8BBD248
- SHA-256: 814EB66B02E73A4DA67FCC6099246C264E610B48AAD08ED0A22D705FABC717E0
- SPKI SHA-256: 9CD4BC95115F48BE510ED2A0BEF678ED09B366D88E5582BC75AE62671E651D82
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaclient1cav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:bd:9f:19:f7:c8:97:9d:b4:e8:bb:d2:48
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Client Root CA v3
        Validity
            Not Before: Mar 25 08:31:56 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Client 1 CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                AF:41:2F:03:2D:AA:C3:08:10:42:42:D8:DF:1E:84:64:E1:28:53:3D
            X509v3 Subject Key Identifier:
                A4:CC:EC:4D:3F:66:3D:68:C0:4D:9F:5E:3A:22:5A:6B:71:6F:53:98
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsaclientrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 814EB66B02E73A4DA67FCC6099246C264E610B48AAD08ED0A22D705FABC717E0
    SPKI SHA256: 9CD4BC95115F48BE510ED2A0BEF678ED09B366D88E5582BC75AE62671E651D82
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsaclientrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Client 2 CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client 2 CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3
- Serial: 018E74D1213320B92D34728BCA2B40
- SHA-256: 1F520582132CD60D8566B8F14D0502A26456BB2E3B9811AAAEE768CCF51774CB
- SPKI SHA-256: 62764EB3AD0C4EDD70D8FE14168EDAA583C4608A7E10501FC8E3D180E3516437
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaclient2cav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:d1:21:33:20:b9:2d:34:72:8b:ca:2b:40
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Client Root CA v3
        Validity
            Not Before: Mar 25 08:53:16 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Client 2 CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                AF:41:2F:03:2D:AA:C3:08:10:42:42:D8:DF:1E:84:64:E1:28:53:3D
            X509v3 Subject Key Identifier:
                B7:6E:3F:34:D5:38:D1:7E:6F:0C:71:C5:50:7F:42:AE:F0:09:EA:60
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsaclientrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1F520582132CD60D8566B8F14D0502A26456BB2E3B9811AAAEE768CCF51774CB
    SPKI SHA256: 62764EB3AD0C4EDD70D8FE14168EDAA583C4608A7E10501FC8E3D180E3516437
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsaclientrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Client 3 CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client 3 CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3
- Serial: 018E74E1F136AED32837977CB331F2
- SHA-256: 945DF0B4A36132746BBA9310841461B4FE42BA05ED35DA0405B5FDBA750F560D
- SPKI SHA-256: 15EE4E90D9C3CD1B6A0AB11D4FF2E3FE7F5B46CA34DC093B9EE54AD4437729DE
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaclient3cav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:e1:f1:36:ae:d3:28:37:97:7c:b3:31:f2
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Client Root CA v3
        Validity
            Not Before: Mar 25 09:11:09 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Client 3 CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                AF:41:2F:03:2D:AA:C3:08:10:42:42:D8:DF:1E:84:64:E1:28:53:3D
            X509v3 Subject Key Identifier:
                1F:21:F1:CD:0D:BA:8B:9B:B1:40:2C:6E:2F:4B:CA:0B:38:BC:11:85
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsaclientrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 945DF0B4A36132746BBA9310841461B4FE42BA05ED35DA0405B5FDBA750F560D
    SPKI SHA256: 15EE4E90D9C3CD1B6A0AB11D4FF2E3FE7F5B46CA34DC093B9EE54AD4437729DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsaclientrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Client Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Client Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD3361BBE86DACA5EDF20753507
- SHA-256: 81B837B929D1E854DFE8A368F264C6E7D928CA1E4A205BA258E17A0C7516E2F1
- SPKI SHA-256: DD61C198B1B3E2960D3E2F57C2F650B5AFA9C8358BD98B5D117809E026B3302F
- Validity: 2023-11-15 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaclientrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:36:1b:be:86:da:ca:5e:df:20:75:35:07
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 13:34:33 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Client Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                AF:41:2F:03:2D:AA:C3:08:10:42:42:D8:DF:1E:84:64:E1:28:53:3D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 81B837B929D1E854DFE8A368F264C6E7D928CA1E4A205BA258E17A0C7516E2F1
    SPKI SHA256: DD61C198B1B3E2960D3E2F57C2F650B5AFA9C8358BD98B5D117809E026B3302F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA DV CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA DV CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Serial: 0193DE404960278E60379873DD78A7
- SHA-256: BF062E12C8BBF2E6685831FE000CAF67342E225A8A249187CC3953B38D40DE04
- SPKI SHA-256: A5B9C344EC312FD8A68980ED41C2872F80F4ECCBC5C87246B1F6A3FE14C7FAEC
- Validity: 2024-12-19 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsadvcav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:93:de:40:49:60:27:8e:60:37:98:73:dd:78:a7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Validity
            Not Before: Dec 19 09:28:06 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA DV CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Subject Key Identifier:
                3A:A5:AD:D6:AF:35:43:9F:F0:12:C6:6F:3A:AF:7B:38:EC:23:2B:7A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarsatlsrootcav3.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BF062E12C8BBF2E6685831FE000CAF67342E225A8A249187CC3953B38D40DE04
    SPKI SHA256: A5B9C344EC312FD8A68980ED41C2872F80F4ECCBC5C87246B1F6A3FE14C7FAEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsatlsrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA DV CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA DV CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Serial: 018E74A948E7C28D5AC4A9D5FCF9F1
- SHA-256: A67F3E67CB1DF2EACF3A404EAFF179374E5E3F4BA0D82E91405DAEADFB0F337D
- SPKI SHA-256: A5B9C344EC312FD8A68980ED41C2872F80F4ECCBC5C87246B1F6A3FE14C7FAEC
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:a9:48:e7:c2:8d:5a:c4:a9:d5:fc:f9:f1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Validity
            Not Before: Mar 25 08:09:09 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA DV CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Subject Key Identifier:
                3A:A5:AD:D6:AF:35:43:9F:F0:12:C6:6F:3A:AF:7B:38:EC:23:2B:7A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsatlsrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A67F3E67CB1DF2EACF3A404EAFF179374E5E3F4BA0D82E91405DAEADFB0F337D
    SPKI SHA256: A5B9C344EC312FD8A68980ED41C2872F80F4ECCBC5C87246B1F6A3FE14C7FAEC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsatlsrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Email CA v6

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email CA v6
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3
- Serial: 018E74F3158BE8763921ABD38E35BF
- SHA-256: BD6E7EDCEBE62E4571F180001568F861DE2AA7AF6D98E7C338D426F54123785B
- SPKI SHA-256: 0B77A86ACF753A8BB6BF127C85309455C2CFC93205D55583099203D55AF3A251
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaemailcav6.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:f3:15:8b:e8:76:39:21:ab:d3:8e:35:bf
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Email Root CA v3
        Validity
            Not Before: Mar 25 09:30:17 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Email CA v6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                87:B9:06:3F:46:C5:29:14:CD:14:5E:C5:9E:23:90:B6:24:AE:66:99
            X509v3 Subject Key Identifier:
                8D:D8:63:2C:D0:D9:BA:77:76:47:21:78:D9:B1:87:68:37:AC:1A:C0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsaemailrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BD6E7EDCEBE62E4571F180001568F861DE2AA7AF6D98E7C338D426F54123785B
    SPKI SHA256: 0B77A86ACF753A8BB6BF127C85309455C2CFC93205D55583099203D55AF3A251
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsaemailrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Email Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Email Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD358A498CC9FDA94E32C5F951A
- SHA-256: D46F8990078A9B2AE08F3C50E9CB1A07373D574003A66BB72EC3A99CBE2A3382
- SPKI SHA-256: 4F73C93162FCCFDA5F07BA556AB97F73F2781ACCECA13CC18BBB899BD6F881D7
- Validity: 2023-11-15 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaemailrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:58:a4:98:cc:9f:da:94:e3:2c:5f:95:1a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 14:16:48 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Email Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                87:B9:06:3F:46:C5:29:14:CD:14:5E:C5:9E:23:90:B6:24:AE:66:99
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D46F8990078A9B2AE08F3C50E9CB1A07373D574003A66BB72EC3A99CBE2A3382
    SPKI SHA256: 4F73C93162FCCFDA5F07BA556AB97F73F2781ACCECA13CC18BBB899BD6F881D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA OV CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA OV CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Serial: 0193DE4F0C094119FB6CCB4DE38B03
- SHA-256: DCC4EA67E1B46C2D00745046F3FBF3115A4E819B92AEE7B92A0F8DBA0796CF9A
- SPKI SHA-256: B8D4C591832902485715A7733F0B3627A88B557E38B9EDFC1FA2CA0BA6A58770
- Validity: 2024-12-19 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsaovcav4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:93:de:4f:0c:09:41:19:fb:6c:cb:4d:e3:8b:03
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Validity
            Not Before: Dec 19 09:44:50 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA OV CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Subject Key Identifier:
                55:D9:A3:70:82:7C:3C:DF:A8:D3:F9:DE:7F:05:D1:BA:66:4B:BF:ED
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarsatlsrootcav3.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DCC4EA67E1B46C2D00745046F3FBF3115A4E819B92AEE7B92A0F8DBA0796CF9A
    SPKI SHA256: B8D4C591832902485715A7733F0B3627A88B557E38B9EDFC1FA2CA0BA6A58770
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsatlsrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA OV CA v4

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA OV CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Serial: 018E74931A11D02462F6E79FD1275A
- SHA-256: F07D383827E264326C5D0DBE257AA82108409F25246F81EE36C8AF222B5A1E43
- SPKI SHA-256: B8D4C591832902485715A7733F0B3627A88B557E38B9EDFC1FA2CA0BA6A58770
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:74:93:1a:11:d0:24:62:f6:e7:9f:d1:27:5a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Validity
            Not Before: Mar 25 07:44:00 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA OV CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Subject Key Identifier:
                55:D9:A3:70:82:7C:3C:DF:A8:D3:F9:DE:7F:05:D1:BA:66:4B:BF:ED
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsatlsrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F07D383827E264326C5D0DBE257AA82108409F25246F81EE36C8AF222B5A1E43
    SPKI SHA256: B8D4C591832902485715A7733F0B3627A88B557E38B9EDFC1FA2CA0BA6A58770
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsatlsrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA qSeal CA v4

- Subject: countryName=SE, organizationIdentifier=NTRSE-556103-4249, organizationName=Telia Company AB, commonName=Telia RSA qSeal CA v4
- Issuer: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Signing Root CA v3
- Serial: 018E75224E2E0CED87D326AC9A27AB
- SHA-256: 709F4003B93F46F1653B76728C9EDE739DAD5095FBE87A80362A856BC840B96A
- SPKI SHA-256: 0F238D82C256B2D8E8F4D7AE40DDE5EB59613B7F65FDB02CEE7F5A699D0A4E17
- Validity: 2024-03-25 to 2048-05-23
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 0.4.0.194112.1.3, 1.3.6.1.4.1.271.2.3.1.1.20
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarsasigningrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:75:22:4e:2e:0c:ed:87:d3:26:ac:9a:27:ab
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = SE, O = Telia Company AB, CN = Telia RSA Signing Root CA v3
        Validity
            Not Before: Mar 25 10:21:40 2024 GMT
            Not After : May 23 10:00:00 2048 GMT
        Subject: C = SE, organizationIdentifier = NTRSE-556103-4249, O = Telia Company AB, CN = Telia RSA qSeal CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                04:7D:A3:E1:33:9F:C9:8A:FB:42:B0:56:C1:14:B9:53:86:35:72:12
            X509v3 Subject Key Identifier:
                B2:82:06:EC:66:38:45:FD:03:B7:04:9D:A7:2E:CF:07:88:60:A5:50
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 0.4.0.194112.1.3
                Policy: 1.3.6.1.4.1.271.2.3.1.1.20
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarsasigningrootcav3.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarsasigningrootcav3.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 709F4003B93F46F1653B76728C9EDE739DAD5095FBE87A80362A856BC840B96A
    SPKI SHA256: 0F238D82C256B2D8E8F4D7AE40DDE5EB59613B7F65FDB02CEE7F5A699D0A4E17
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 0.4.0.194112.1.3, 1.3.6.1.4.1.271.2.3.1.1.20
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarsasigningrootcav3.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarsasigningrootcav3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA Signing Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA Signing Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD34A1B045C53A3969D2C90B5B8
- SHA-256: 8CEF3433AB3C3F4A3C5D395B82B4EAA250E9BF647BC6095ECF0B57620F5DA9BF
- SPKI SHA-256: 2F3C2359C650387B1FD12F6AF6485D8101B4D718781AF15BB7DAE54BB92D1AF7
- Validity: 2023-11-15 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsasigningrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d3:4a:1b:04:5c:53:a3:96:9d:2c:90:b5:b8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 14:00:35 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA Signing Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                04:7D:A3:E1:33:9F:C9:8A:FB:42:B0:56:C1:14:B9:53:86:35:72:12
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8CEF3433AB3C3F4A3C5D395B82B4EAA250E9BF647BC6095ECF0B57620F5DA9BF
    SPKI SHA256: 2F3C2359C650387B1FD12F6AF6485D8101B4D718781AF15BB7DAE54BB92D1AF7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: 1.2.840.113583.1.1.5, 1.3.6.1.5.5.7.3.36, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 018BD2F900F7301C73EC5F583AEBCE
- SHA-256: 6DD4E12B751849BA3E1AD90AC48674C2474C772182F3500C85C2DF4DB7F48866
- SPKI SHA-256: 536CFDAE8A6257BF14266C43285958D0F9B937E3068E2A215374170133A9FFCC
- Validity: 2023-11-15 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8b:d2:f9:00:f7:30:1c:73:ec:5f:58:3a:eb:ce
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 15 12:30:58 2023 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6DD4E12B751849BA3E1AD90AC48674C2474C772182F3500C85C2DF4DB7F48866
    SPKI SHA256: 536CFDAE8A6257BF14266C43285958D0F9B937E3068E2A215374170133A9FFCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia RSA TLS Root CA v3

- Subject: countryName=SE, organizationName=Telia Company AB, commonName=Telia RSA TLS Root CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 0193DE17F68BE68D449747E0828F56
- SHA-256: 5573DFB5C894B95B85D26F9C57591257561A09CD37726D13835ECAC28A1E9C7C
- SPKI SHA-256: 536CFDAE8A6257BF14266C43285958D0F9B937E3068E2A215374170133A9FFCC
- Validity: 2024-12-19 to 2043-11-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliarsatlsrootcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:93:de:17:f6:8b:e6:8d:44:97:47:e0:82:8f:56
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Dec 19 08:43:55 2024 GMT
            Not After : Nov 28 10:00:00 2043 GMT
        Subject: C = SE, O = Telia Company AB, CN = Telia RSA TLS Root CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                B0:C7:A9:D2:DD:B2:28:56:73:04:94:8C:14:5C:48:6F:37:52:92:A8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5573DFB5C894B95B85D26F9C57591257561A09CD37726D13835ECAC28A1E9C7C
    SPKI SHA256: 536CFDAE8A6257BF14266C43285958D0F9B937E3068E2A215374170133A9FFCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Telia Server CA v3

- Subject: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Server CA v3
- Issuer: countryName=FI, organizationName=Telia Finland Oyj, commonName=Telia Root CA v2
- Serial: 01675FE78F10F349257F16B3731F7A
- SHA-256: 1281AD8FABE883F209E9636448D1A80C373DAA7686C813A270FAD48F5F5E589A
- SPKI SHA-256: 4C28132E2800299DA8B963354F6761F761BDC140CFF169666BAB2AC269B76957
- Validity: 2018-11-29 to 2043-11-29
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliaservercav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:67:5f:e7:8f:10:f3:49:25:7f:16:b3:73:1f:7a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Telia Finland Oyj, CN = Telia Root CA v2
        Validity
            Not Before: Nov 29 14:36:05 2018 GMT
            Not After : Nov 29 11:55:54 2043 GMT
        Subject: C = FI, O = Telia Finland Oyj, CN = Telia Server CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                72:AC:E4:33:79:AA:45:87:F6:FD:AC:1D:9E:D6:C7:2F:86:D8:24:39
            X509v3 Subject Key Identifier:
                46:66:8D:0E:07:23:16:B0:EA:4F:05:EB:96:5A:DE:A5:EE:C9:7E:A4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
                  CPS: https://cps.trust.telia.com/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliarootcav2.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.telia.com
                CA Issuers - URI:http://cps.trust.telia.com/teliarootcav2.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 1281AD8FABE883F209E9636448D1A80C373DAA7686C813A270FAD48F5F5E589A
    SPKI SHA256: 4C28132E2800299DA8B963354F6761F761BDC140CFF169666BAB2AC269B76957
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliarootcav2.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliarootcav2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Class 1 CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 26833534C485868C5EE0B92EF5CA5303
- SHA-256: 8072F44E162FD430D83C4FFF1C0B7F248258E4ABB2AEA8C4719AA5F3FD23C626
- SPKI SHA-256: D87EFB79891C8B2BE0457EA7231284401F4DFD766893836B1CC489C6FA7B13E3
- Validity: 2007-10-24 to 2019-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraclass1cav1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            26:83:35:34:c4:85:86:8c:5e:e0:b9:2e:f5:ca:53:03
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 24 07:14:56 2007 GMT
            Not After : Oct 17 05:07:08 2019 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Class 1 CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
                Full Name:
                  URI:http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Subject Key Identifier:
                F5:EA:33:8C:F8:A5:2E:8C:A6:82:6B:4D:8B:32:2A:A7:B7:53:CF:CC
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 8072F44E162FD430D83C4FFF1C0B7F248258E4ABB2AEA8C4719AA5F3FD23C626
    SPKI SHA256: D87EFB79891C8B2BE0457EA7231284401F4DFD766893836B1CC489C6FA7B13E3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TeliaSonera Class 1 CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: F85D2F190C609F1494B28DF9C1D1E74C
- SHA-256: CEDBC6EEE71BBE0D4EE5A728B4215A4C634C654D44F737F2E3BA35E0A295FBF4
- SPKI SHA-256: D87EFB79891C8B2BE0457EA7231284401F4DFD766893836B1CC489C6FA7B13E3
- Validity: 2013-05-13 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f8:5d:2f:19:0c:60:9f:14:94:b2:8d:f9:c1:d1:e7:4c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 13 08:00:30 2013 GMT
            Not After : Oct 17 20:59:00 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Class 1 CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F5:EA:33:8C:F8:A5:2E:8C:A6:82:6B:4D:8B:32:2A:A7:B7:53:CF:CC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: CEDBC6EEE71BBE0D4EE5A728B4215A4C634C654D44F737F2E3BA35E0A295FBF4
    SPKI SHA256: D87EFB79891C8B2BE0457EA7231284401F4DFD766893836B1CC489C6FA7B13E3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_country_name_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Class 1 CA v2

- Subject: countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 0189FD21070C754AB18FF930ACE7A1
- SHA-256: F6E0D3006465585AA276E40861945102B2660708399879062FD53A2040EB5B31
- SPKI SHA-256: EE28911AE7667C1E531745E3BFBBBF1026237E5C2339556FB967D7A9E0CBF6FF
- Validity: 2023-08-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraclass1cav2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.11
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:21:07:0c:75:4a:b1:8f:f9:30:ac:e7:a1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Aug 16 06:50:00 2023 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = FI, O = TeliaSonera, CN = TeliaSonera Class 1 CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                D1:47:22:8F:CB:A8:5D:1A:FE:26:41:46:6E:CB:82:4B:65:7D:8A:E4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.11
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6E0D3006465585AA276E40861945102B2660708399879062FD53A2040EB5B31
    SPKI SHA256: EE28911AE7667C1E531745E3BFBBBF1026237E5C2339556FB967D7A9E0CBF6FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.11
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Class 1 CA v2

- Subject: countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Class 1 CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: FD41DD7FD19F3EE9F85D9E437133D4DB
- SHA-256: B95AE54F838E3ABF0B57ACCC1B1266DC68C7A3FA774015FA128D60CDD1AAE280
- SPKI SHA-256: EE28911AE7667C1E531745E3BFBBBF1026237E5C2339556FB967D7A9E0CBF6FF
- Validity: 2014-10-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraclass1cav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fd:41:dd:7f:d1:9f:3e:e9:f8:5d:9e:43:71:33:d4:db
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 16 08:31:53 2014 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = FI, O = TeliaSonera, CN = TeliaSonera Class 1 CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Subject Key Identifier:
                D1:47:22:8F:CB:A8:5D:1A:FE:26:41:46:6E:CB:82:4B:65:7D:8A:E4
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: B95AE54F838E3ABF0B57ACCC1B1266DC68C7A3FA774015FA128D60CDD1AAE280
    SPKI SHA256: EE28911AE7667C1E531745E3BFBBBF1026237E5C2339556FB967D7A9E0CBF6FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Class 2 CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 34A9F5D287793EC035CCF673F7B3BF49
- SHA-256: 04096545767B1285A0F03A2C9684B0E9FBC7F43A9E2FDFE723687DA7445A3823
- SPKI SHA-256: C49F76006EDFECE976AE24050DB6DA756C500D7F3F2D47C69323389D48D13A4C
- Validity: 2007-10-18 to 2019-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraclass2cav1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:a9:f5:d2:87:79:3e:c0:35:cc:f6:73:f7:b3:bf:49
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 18 13:21:36 2007 GMT
            Not After : Oct 17 05:05:44 2019 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Class 2 CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
                Full Name:
                  URI:http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Subject Key Identifier:
                D4:6D:BD:B2:55:BB:52:4B:2A:E8:B3:DF:6D:A7:D8:01:FB:67:9F:72
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 04096545767B1285A0F03A2C9684B0E9FBC7F43A9E2FDFE723687DA7445A3823
    SPKI SHA256: C49F76006EDFECE976AE24050DB6DA756C500D7F3F2D47C69323389D48D13A4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TeliaSonera Class 2 CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: D0D772729A041797F89EDAE382F91F11
- SHA-256: 82EEB75D9E072AF766ABCFD2A5F44A559BB2EC74BD8098C9E28C60ABCE9EABF2
- SPKI SHA-256: C49F76006EDFECE976AE24050DB6DA756C500D7F3F2D47C69323389D48D13A4C
- Validity: 2013-05-13 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d0:d7:72:72:9a:04:17:97:f8:9e:da:e3:82:f9:1f:11
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 13 07:52:23 2013 GMT
            Not After : Oct 17 20:59:00 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Class 2 CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D4:6D:BD:B2:55:BB:52:4B:2A:E8:B3:DF:6D:A7:D8:01:FB:67:9F:72
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 82EEB75D9E072AF766ABCFD2A5F44A559BB2EC74BD8098C9E28C60ABCE9EABF2
    SPKI SHA256: C49F76006EDFECE976AE24050DB6DA756C500D7F3F2D47C69323389D48D13A4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_country_name_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Class 2 CA v2

- Subject: countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 637C0BD785A5BF29DA602D7C4D7A70B1
- SHA-256: 092829433D231949F4A9BC666CBF54B3AA27D7BEBCA048D75E59093E15A72EA5
- SPKI SHA-256: 96A31F39361CB7DACCC7F6362E91C8F1A66DF718161D7FD3C0B2D0E75350974E
- Validity: 2014-10-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraclass2cav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:7c:0b:d7:85:a5:bf:29:da:60:2d:7c:4d:7a:70:b1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 16 08:39:30 2014 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = SE, O = TeliaSonera, CN = TeliaSonera Class 2 CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Subject Key Identifier:
                9E:19:FF:E5:0D:3A:FE:00:97:15:3F:69:F1:DC:5A:3C:AA:0C:94:83
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 092829433D231949F4A9BC666CBF54B3AA27D7BEBCA048D75E59093E15A72EA5
    SPKI SHA256: 96A31F39361CB7DACCC7F6362E91C8F1A66DF718161D7FD3C0B2D0E75350974E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Class 2 CA v2

- Subject: countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Class 2 CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 0189FD2AD523180F7435293E8BBB2F
- SHA-256: 10D081A9541BF0B388818447A2A75465809AA5FB9A3DF375602472E873432AC1
- SPKI SHA-256: 96A31F39361CB7DACCC7F6362E91C8F1A66DF718161D7FD3C0B2D0E75350974E
- Validity: 2023-08-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraclass2cav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.12
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:2a:d5:23:18:0f:74:35:29:3e:8b:bb:2f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Aug 16 07:03:30 2023 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = SE, O = TeliaSonera, CN = TeliaSonera Class 2 CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                9E:19:FF:E5:0D:3A:FE:00:97:15:3F:69:F1:DC:5A:3C:AA:0C:94:83
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.12
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 10D081A9541BF0B388818447A2A75465809AA5FB9A3DF375602472E873432AC1
    SPKI SHA256: 96A31F39361CB7DACCC7F6362E91C8F1A66DF718161D7FD3C0B2D0E75350974E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.12
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Email CA v3

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Email CA v3
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 4A696451B213EAEB4C8677DD1EE52371
- SHA-256: 152D7A4957123BFCE4AD13F7DECCAEB6B8CD80765A08C59F08263C91DF88B65E
- SPKI SHA-256: DDBC9CF7CA9844D80CE16905CA231AAEC2934DE4D636B2C6FDD9A5075200C4CC
- Validity: 2007-10-18 to 2019-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraemailcav3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:69:64:51:b2:13:ea:eb:4c:86:77:dd:1e:e5:23:71
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 18 13:06:34 2007 GMT
            Not After : Oct 17 05:05:19 2019 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Email CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
                Full Name:
                  URI:http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Subject Key Identifier:
                F3:74:B8:1D:13:33:D1:C9:AD:5B:CE:66:28:9A:99:32:81:F0:20:CE
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 152D7A4957123BFCE4AD13F7DECCAEB6B8CD80765A08C59F08263C91DF88B65E
    SPKI SHA256: DDBC9CF7CA9844D80CE16905CA231AAEC2934DE4D636B2C6FDD9A5075200C4CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TeliaSonera Email CA v3

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Email CA v3
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 8151AD728B67A57FA455248D81D357F9
- SHA-256: F5EB4C2182D379D18FF2E4A6ED3FA79B330EED1ACD94D2BC956C0B70CF2D51FB
- SPKI SHA-256: DDBC9CF7CA9844D80CE16905CA231AAEC2934DE4D636B2C6FDD9A5075200C4CC
- Validity: 2013-05-13 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Organizational_User_Certificate_CPS_v1.1.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            81:51:ad:72:8b:67:a5:7f:a4:55:24:8d:81:d3:57:f9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 13 08:07:22 2013 GMT
            Not After : Oct 17 20:59:00 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Email CA v3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F3:74:B8:1D:13:33:D1:C9:AD:5B:CE:66:28:9A:99:32:81:F0:20:CE
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: F5EB4C2182D379D18FF2E4A6ED3FA79B330EED1ACD94D2BC956C0B70CF2D51FB
    SPKI SHA256: DDBC9CF7CA9844D80CE16905CA231AAEC2934DE4D636B2C6FDD9A5075200C4CC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_country_name_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Email CA v4

- Subject: countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Email CA v4
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 0189FD3657E179D49C98DB25C658F5
- SHA-256: 77D82B83905D4465A3EB6B62E42081A7C273632F7D6CDA33A1E366987420AD12
- SPKI SHA-256: B744E1DD372B6E1DEA04A74F4E232889588C6A97591061B6F725B285614E9EEF
- Validity: 2023-08-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraemailcav4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.14, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.telia.com
- CRL DP: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:89:fd:36:57:e1:79:d4:9c:98:db:25:c6:58:f5
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Aug 16 07:13:00 2023 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = SE, O = TeliaSonera, CN = TeliaSonera Email CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                89:86:2A:82:D1:78:FA:F0:A6:29:54:35:87:95:6F:D3:77:60:19:F0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.14
                Policy: 2.23.140.1.5.1.1
                Policy: 2.23.140.1.5.3.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                CA Issuers - URI:http://cps.trust.telia.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.telia.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 77D82B83905D4465A3EB6B62E42081A7C273632F7D6CDA33A1E366987420AD12
    SPKI SHA256: B744E1DD372B6E1DEA04A74F4E232889588C6A97591061B6F725B285614E9EEF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.14, 2.23.140.1.5.1.1, 2.23.140.1.5.3.1
- AIA OCSP: http://ocsp.trust.telia.com
- AIA CA Issuers: http://cps.trust.telia.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Email CA v4

- Subject: countryName=SE, organizationName=TeliaSonera, commonName=TeliaSonera Email CA v4
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 52EBA0D8B74B46EB8557CD6DA2A3DDDD
- SHA-256: D1F2656AC8382739A3B087C47AB5CAB945A32F162B6149C308783C7E06AF8AE8
- SPKI SHA-256: B744E1DD372B6E1DEA04A74F4E232889588C6A97591061B6F725B285614E9EEF
- Validity: 2014-10-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraemailcav4.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:eb:a0:d8:b7:4b:46:eb:85:57:cd:6d:a2:a3:dd:dd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 16 08:47:43 2014 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = SE, O = TeliaSonera, CN = TeliaSonera Email CA v4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Subject Key Identifier:
                89:86:2A:82:D1:78:FA:F0:A6:29:54:35:87:95:6F:D3:77:60:19:F0
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D1F2656AC8382739A3B087C47AB5CAB945A32F162B6149C308783C7E06AF8AE8
    SPKI SHA256: B744E1DD372B6E1DEA04A74F4E232889588C6A97591061B6F725B285614E9EEF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Extended Validation SSL CA v1

- Subject: countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Extended Validation SSL CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 9938B8D60628EA592E26010FD266E811
- SHA-256: 9032A3A421B6735FFB85E604D56179924C7760EDC08E4A1A7750D4D32FBC799B
- SPKI SHA-256: 9797DF2DB471DA1A49BEE19205D1AA3177DDAE057D00075E1FECE4483C004426
- Validity: 2015-03-16 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            99:38:b8:d6:06:28:ea:59:2e:26:01:0f:d2:66:e8:11
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Mar 16 08:37:37 2015 GMT
            Not After : Oct 17 10:29:00 2032 GMT
        Subject: C = FI, O = TeliaSonera, CN = TeliaSonera Extended Validation SSL CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.trust.teliasonera.com/CPS
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                08:E4:FA:72:D5:43:3B:C2:5C:24:9B:95:92:40:F3:D0:9F:7A:A8:30
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9032A3A421B6735FFB85E604D56179924C7760EDC08E4A1A7750D4D32FBC799B
    SPKI SHA256: 9797DF2DB471DA1A49BEE19205D1AA3177DDAE057D00075E1FECE4483C004426
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Gateway CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Gateway CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 35791D8792516D61B11C4BEFAF76C1DA
- SHA-256: A2A009108B3374401E41E859CC0ED176234ABAD9DC25894967F359D06C863506
- SPKI SHA-256: 763456634C2BDC951A450F936B68C14D8CD1DE7BE081D78259EBEEA5A791B3C1
- Validity: 2013-05-13 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:79:1d:87:92:51:6d:61:b1:1c:4b:ef:af:76:c1:da
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 13 08:20:14 2013 GMT
            Not After : Oct 17 20:59:00 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Gateway CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                8F:59:95:28:26:A2:B0:6D:19:49:99:D2:FB:B0:84:47:4D:CB:95:FC
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: A2A009108B3374401E41E859CC0ED176234ABAD9DC25894967F359D06C863506
    SPKI SHA256: 763456634C2BDC951A450F936B68C14D8CD1DE7BE081D78259EBEEA5A791B3C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_country_name_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Gateway CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Gateway CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 4031E7FA71DF6D52E05894A606B5D7F3
- SHA-256: B01A8DC9426D48767157FFCB46BEFA193175BBC981B57D47BC6C7FF71B94A35C
- SPKI SHA-256: 763456634C2BDC951A450F936B68C14D8CD1DE7BE081D78259EBEEA5A791B3C1
- Validity: 2010-03-04 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:31:e7:fa:71:df:6d:52:e0:58:94:a6:06:b5:d7:f3
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Mar  4 09:28:37 2010 GMT
            Not After : Oct 17 08:28:37 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Gateway CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
                  URI:http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Subject Key Identifier:
                8F:59:95:28:26:A2:B0:6D:19:49:99:D2:FB:B0:84:47:4D:CB:95:FC
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: B01A8DC9426D48767157FFCB46BEFA193175BBC981B57D47BC6C7FF71B94A35C
    SPKI SHA256: 763456634C2BDC951A450F936B68C14D8CD1DE7BE081D78259EBEEA5A791B3C1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers

### TeliaSonera Gateway CA v2

- Subject: countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Gateway CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 863C75641195854FB43138A0A0CF8AA3
- SHA-256: 46226B7B89E02CA8F5D85D67ED8CB4B19C48382058BB16242199D540CABE9268
- SPKI SHA-256: 8DA689B0D575D20916E6E8B59A9AE73A18F4014F4996F7C7C1F784FB8A46ECB8
- Validity: 2014-10-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneragatewaycav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:3c:75:64:11:95:85:4f:b4:31:38:a0:a0:cf:8a:a3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 16 08:21:22 2014 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = FI, O = TeliaSonera, CN = TeliaSonera Gateway CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Subject Key Identifier:
                87:AA:E3:13:12:9F:11:8B:CA:68:CD:1E:2D:C4:29:A8:FA:10:1A:CB
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 46226B7B89E02CA8F5D85D67ED8CB4B19C48382058BB16242199D540CABE9268
    SPKI SHA256: 8DA689B0D575D20916E6E8B59A9AE73A18F4014F4996F7C7C1F784FB8A46ECB8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Mobile ID CA v1

- Subject: countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: D76A8BC5050900A19B445C8728CCA636
- SHA-256: 6183DEF27DE089E8E9F4BAF59FE5921829B26D9EE41442B9EEEAFD19CEDD3706
- SPKI SHA-256: E5556FA67F434DDB241EB0E6ED1EAAC0CADE1D21AFC335ABB38E63B9575A6B3F
- Validity: 2014-10-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.2.246.277.1.11.4.1.2.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d7:6a:8b:c5:05:09:00:a1:9b:44:5c:87:28:cc:a6:36
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 16 09:02:55 2014 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = FI, O = TeliaSonera Finland Oyj, CN = TeliaSonera Mobile ID CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.2.246.277.1.11.4.1.2.1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                53:80:2C:E5:18:4B:1E:C1:0B:D6:26:2C:D1:08:EF:88:86:DD:2C:0E
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6183DEF27DE089E8E9F4BAF59FE5921829B26D9EE41442B9EEEAFD19CEDD3706
    SPKI SHA256: E5556FA67F434DDB241EB0E6ED1EAAC0CADE1D21AFC335ABB38E63B9575A6B3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 1.2.246.277.1.11.4.1.2.1
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Mobile ID CA v1

- Subject: countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 01638BEA734AFAF87F6E5124371F72
- SHA-256: 31046C3D7C5E9401707F6817C55AF5B1FC4A4DDC70846B7BED422F96C7CAD6A5
- SPKI SHA-256: E5556FA67F434DDB241EB0E6ED1EAAC0CADE1D21AFC335ABB38E63B9575A6B3F
- Validity: 2018-05-23 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.246.277.1.11.4.1.2.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:63:8b:ea:73:4a:fa:f8:7f:6e:51:24:37:1f:72
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 23 07:29:55 2018 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = FI, O = TeliaSonera Finland Oyj, CN = TeliaSonera Mobile ID CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                53:80:2C:E5:18:4B:1E:C1:0B:D6:26:2C:D1:08:EF:88:86:DD:2C:0E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: 1.2.246.277.1.11.4.1.2.1
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Extended Key Usage:
                TLS Web Client Authentication
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 31046C3D7C5E9401707F6817C55AF5B1FC4A4DDC70846B7BED422F96C7CAD6A5
    SPKI SHA256: E5556FA67F434DDB241EB0E6ED1EAAC0CADE1D21AFC335ABB38E63B9575A6B3F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication
- Certificate Policies: 1.2.246.277.1.11.4.1.2.1
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Mobile ID CA v2

- Subject: countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 0161AE3E8933E5B8958AEF929C0CEB
- SHA-256: C1245A9A039CC511BCFB3A50BE1D89A989933431F25C0F9665BA977F94F876C1
- SPKI SHA-256: 70331FCAE82F16C5F232EAEB3B927D1C1E9ABC0597A3DC0C4B59D3FFC32DECA0
- Validity: 2018-02-19 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneramobileidcav2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:61:ae:3e:89:33:e5:b8:95:8a:ef:92:9c:0c:eb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Feb 19 13:25:46 2018 GMT
            Not After : Oct 17 09:31:46 2032 GMT
        Subject: C = FI, O = TeliaSonera Finland Oyj, CN = TeliaSonera Mobile ID CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 Subject Key Identifier:
                D0:2D:D3:14:F0:77:4A:62:27:2C:65:53:93:D5:A5:A5:43:AF:C2:52
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.trust.teliasonera.com/mobile-id/
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Time Stamping
            Authority Information Access:
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
                OCSP - URI:http://ocsp.trust.teliasonera.com
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: C1245A9A039CC511BCFB3A50BE1D89A989933431F25C0F9665BA977F94F876C1
    SPKI SHA256: 70331FCAE82F16C5F232EAEB3B927D1C1E9ABC0597A3DC0C4B59D3FFC32DECA0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Mobile ID CA v2

- Subject: countryName=FI, organizationName=TeliaSonera Finland Oyj, commonName=TeliaSonera Mobile ID CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 0375C49B7E63CE433707FF198437A5EF
- SHA-256: D9121A35775309EC74B7C888EA126509E9452C35D8B9EE1F252782FF2287A499
- SPKI SHA-256: 70331FCAE82F16C5F232EAEB3B927D1C1E9ABC0597A3DC0C4B59D3FFC32DECA0
- Validity: 2016-01-26 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:75:c4:9b:7e:63:ce:43:37:07:ff:19:84:37:a5:ef
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Jan 26 07:35:46 2016 GMT
            Not After : Oct 17 09:31:46 2032 GMT
        Subject: C = FI, O = TeliaSonera Finland Oyj, CN = TeliaSonera Mobile ID CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://repository.trust.teliasonera.com/mobile-id/
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, Time Stamping
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                D0:2D:D3:14:F0:77:4A:62:27:2C:65:53:93:D5:A5:A5:43:AF:C2:52
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D9121A35775309EC74B7C888EA126509E9452C35D8B9EE1F252782FF2287A499
    SPKI SHA256: 70331FCAE82F16C5F232EAEB3B927D1C1E9ABC0597A3DC0C4B59D3FFC32DECA0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Root CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Issuer: countryName=FI, organizationName=Sonera, commonName=Sonera Class2 CA
- Serial: D1E03E5B48EDC79E093F40DEE161C38B
- SHA-256: 881DF16CD54E4D89735B7D19811D673D17C0063984EA11E72D6701BF3F41720B
- SPKI SHA-256: 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B
- Validity: 2007-10-18 to 2019-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=Sonera%20Class2%20CA, http://crl-2.trust.teliasonera.com/soneraclass2ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d1:e0:3e:5b:48:ed:c7:9e:09:3f:40:de:e1:61:c3:8b
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = FI, O = Sonera, CN = Sonera Class2 CA
        Validity
            Not Before: Oct 18 12:52:01 2007 GMT
            Not After : Oct 17 05:04:11 2019 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/soneraclass2ca.cer
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=Sonera%20Class2%20CA,o=Sonera,c=FI?certificaterevocationlist;binary
                Full Name:
                  URI:http://crl-2.trust.teliasonera.com/soneraclass2ca.crl
            X509v3 Authority Key Identifier:
                4A:A0:AA:58:84:D3:5E:3C
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 881DF16CD54E4D89735B7D19811D673D17C0063984EA11E72D6701BF3F41720B
    SPKI SHA256: 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/soneraclass2ca.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=Sonera%20Class2%20CA, http://crl-2.trust.teliasonera.com/soneraclass2ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TeliaSonera Root CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Issuer: countryName=FI, organizationName=Sonera, commonName=Sonera Class2 CA
- Serial: 87ED2E1A28264AC519AA3AEBB90DA2CB
- SHA-256: E9563581E712B290F23A749346535EB0D981E3D4A39D56D604684CD0B1698C89
- SPKI SHA-256: 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B
- Validity: 2014-12-05 to 2021-04-05
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasonerarootcav1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=Sonera%20Class2%20CA, http://crl-2.trust.teliasonera.com/soneraclass2ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            87:ed:2e:1a:28:26:4a:c5:19:aa:3a:eb:b9:0d:a2:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = FI, O = Sonera, CN = Sonera Class2 CA
        Validity
            Not Before: Dec  5 08:19:15 2014 GMT
            Not After : Apr  5 10:29:00 2021 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/soneraclass2ca.cer
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=Sonera%20Class2%20CA,o=Sonera,c=FI?certificaterevocationlist;binary
                Full Name:
                  URI:http://crl-2.trust.teliasonera.com/soneraclass2ca.crl
            X509v3 Authority Key Identifier:
                4A:A0:AA:58:84:D3:5E:3C
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E9563581E712B290F23A749346535EB0D981E3D4A39D56D604684CD0B1698C89
    SPKI SHA256: 10BA3485CA8BB6880AB9531A4063E4001555561C7F2E055165F49B2D74FC5F6B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/soneraclass2ca.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=Sonera%20Class2%20CA, http://crl-2.trust.teliasonera.com/soneraclass2ca.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_country_name_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TeliaSonera Server CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Server CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 10684A0D86E843592D16746A88152F81
- SHA-256: 6D553BED166EC5972B2BCC7058F4B613C89DEFDBAD5F67D4F23E6FA0087A53FC
- SPKI SHA-256: B08C010E92E77DFED183AA7C597724A4382F59BD2FB28C09AC6DAAC01C5B0A81
- Validity: 2013-05-13 to 2032-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:68:4a:0d:86:e8:43:59:2d:16:74:6a:88:15:2f:81
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: May 13 08:13:28 2013 GMT
            Not After : Oct 17 20:59:00 2032 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Server CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier:
                A0:81:BE:55:9B:F3:7F:61:05:84:8B:2D:0C:3B:E0:08:49:EE:57:3E
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 6D553BED166EC5972B2BCC7058F4B613C89DEFDBAD5F67D4F23E6FA0087A53FC
    SPKI SHA256: B08C010E92E77DFED183AA7C597724A4382F59BD2FB28C09AC6DAAC01C5B0A81
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_ca_country_name_missing: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TeliaSonera Server CA v1

- Subject: organizationName=TeliaSonera, commonName=TeliaSonera Server CA v1
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 40B2E8EFFD9FA6E4BDFE34B6973EB8A9
- SHA-256: 209BBEEB6464E945D82A36D9F4469300EDA22B8418E449EDCD3CC1E0B3D43938
- SPKI SHA-256: B08C010E92E77DFED183AA7C597724A4382F59BD2FB28C09AC6DAAC01C5B0A81
- Validity: 2007-10-24 to 2019-10-17
- Key: RSA 4096
- Signature Algorithm: RSA-SHA1

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf, https://repository.trust.teliasonera.com/TeliaSonera_Server_Certificate_CPS_v1.5.pdf
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraservercav1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: true
- Revoked: false
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:b2:e8:ef:fd:9f:a6:e4:bd:fe:34:b6:97:3e:b8:a9
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 24 07:21:15 2007 GMT
            Not After : Oct 17 05:03:51 2019 GMT
        Subject: O = TeliaSonera, CN = TeliaSonera Server CA v1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                CA Issuers - URI:http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
                Full Name:
                  URI:http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
            X509v3 Subject Key Identifier:
                A0:81:BE:55:9B:F3:7F:61:05:84:8B:2D:0C:3B:E0:08:49:EE:57:3E
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha1WithRSAEncryption
    SHA256 Fingerprint: 209BBEEB6464E945D82A36D9F4469300EDA22B8418E449EDCD3CC1E0B3D43938
    SPKI SHA256: B08C010E92E77DFED183AA7C597724A4382F59BD2FB28C09AC6DAAC01C5B0A81
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: -
- AIA CA Issuers: http://ca.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1, http://crl-2.trust.teliasonera.com/teliasonerarootcav1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_http_urls
- has_crldp
- has_aia_ca_issuers
- is_expired

### TeliaSonera Server CA v2

- Subject: countryName=FI, organizationName=TeliaSonera, commonName=TeliaSonera Server CA v2
- Issuer: organizationName=TeliaSonera, commonName=TeliaSonera Root CA v1
- Serial: 4C462AF6DBFBF7804F84C17CFEA972B6
- SHA-256: D721110388CA6F20BBA9FD1A8DBA4EFB8C16392A3DEBAD97C553EEAF0ACACAAC
- SPKI SHA-256: 16ADD8311DA26CB829A03E74F5E8090E7E5C3D73DF9D70B9314776216C15FEA0
- Validity: 2014-10-16 to 2032-10-16
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://httpcrl.trust.telia.com/teliasoneraservercav2.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.trust.teliasonera.com
- CRL DP: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4c:46:2a:f6:db:fb:f7:80:4f:84:c1:7c:fe:a9:72:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O = TeliaSonera, CN = TeliaSonera Root CA v1
        Validity
            Not Before: Oct 16 08:09:57 2014 GMT
            Not After : Oct 16 05:04:00 2032 GMT
        Subject: C = FI, O = TeliaSonera, CN = TeliaSonera Server CA v2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access:
                OCSP - URI:http://ocsp.trust.teliasonera.com
                CA Issuers - URI:http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.271.2.3.1.1.2
                  CPS: https://repository.trust.teliasonera.com/CPS
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl
                Full Name:
                  URI:ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1,o=TeliaSonera?certificaterevocationlist;binary
            X509v3 Subject Key Identifier:
                2F:49:3C:29:4F:D7:07:25:F9:C6:8C:D5:64:F5:66:3D:12:83:22:95
            X509v3 Authority Key Identifier:
                F0:8F:59:38:00:B3:F5:8F:9A:96:0C:D5:EB:FA:7B:AA:17:E8:13:12
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D721110388CA6F20BBA9FD1A8DBA4EFB8C16392A3DEBAD97C553EEAF0ACACAAC
    SPKI SHA256: 16ADD8311DA26CB829A03E74F5E8090E7E5C3D73DF9D70B9314776216C15FEA0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 1.3.6.1.4.1.271.2.3.1.1.2
- AIA OCSP: http://ocsp.trust.teliasonera.com
- AIA CA Issuers: http://repository.trust.teliasonera.com/teliasonerarootcav1.cer
- CRL Distribution Points: http://crl-3.trust.teliasonera.com/teliasonerarootcav1.crl, ldap://crl-1.trust.teliasonera.com/cn=TeliaSonera%20Root%20CA%20v1
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
