# CA Owner Audit Dump - TrustAsia Technologies, Inc.

Generated: 2026-07-28T05:56:42.585083Z

## CA Owner Summary

- Name: TrustAsia Technologies, Inc.
- Country: China
- Website: -
- Problem Reporting: revoke[at]trustasia[dot]com
- CP/CPS URLs: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf, https://repository.trustasia.com/repo/cps/adoc/TrustAsia-Global-CP-CPS_EN_V2.1.3.adoc
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d21a17b2-b089-4847-a9c6-f55239f76ed1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6fccae8-47f1-41da-a597-49f608d96ae7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a8e69828-d765-4fe1-81e9-15971621c7e2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c1171bd1-4f04-4c3a-bb92-ef85f5e74573, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ddc533c8-15c4-4789-abeb-9f5f10c7ac2d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=94d668c8-939e-420d-9684-744f0831295e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=498e7db8-79f0-4ffc-acf8-66a80932b53b
- Root Programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Not Included","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: revoke[at]trustasia[dot]com
- CP/CPS URLs: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf, https://repository.trustasia.com/repo/cps/adoc/TrustAsia-Global-CP-CPS_EN_V2.1.3.adoc
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d21a17b2-b089-4847-a9c6-f55239f76ed1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6fccae8-47f1-41da-a597-49f608d96ae7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a8e69828-d765-4fe1-81e9-15971621c7e2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c1171bd1-4f04-4c3a-bb92-ef85f5e74573, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ddc533c8-15c4-4789-abeb-9f5f10c7ac2d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=94d668c8-939e-420d-9684-744f0831295e, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=498e7db8-79f0-4ffc-acf8-66a80932b53b
- Repository URLs: https://repository.trustasia.com/
- Root programs: {"mozilla":"Not Yet Included","chrome":"Not Included","microsoft":"Not Included","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS ECC Root CA | yes | unknown | 2024-05-15 to 2049-05-15 | - | - | - | current errors: 1 |
| 2 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS RSA Root CA | yes | unknown | 2024-05-15 to 2049-05-15 | - | - | - | clean |
| 3 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1 | yes | unknown | 2020-08-27 to 2045-08-26 | - | - | - | clean |
| 4 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G2 | yes | unknown | 2020-08-27 to 2045-08-26 | - | - | - | clean |
| 5 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3 | yes | unknown | 2021-05-20 to 2046-05-19 | - | - | - | clean |
| 6 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4 | yes | unknown | 2021-05-20 to 2046-05-19 | - | - | - | clean |
| 7 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME ECC Root CA | yes | unknown | 2024-05-15 to 2044-05-15 | - | - | - | current errors: 1 |
| 8 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME RSA Root CA | yes | unknown | 2024-05-15 to 2044-05-15 | - | - | - | clean |
| 9 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA | yes | unknown | 2024-05-15 to 2044-05-15 | - | - | - | current errors: 1 |
| 10 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA | yes | unknown | 2024-05-15 to 2044-05-15 | - | - | - | clean |
| 11 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA ECC Root CA | yes | unknown | 2024-05-15 to 2049-05-15 | - | - | - | current errors: 1 |
| 12 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA RSA Root CA | yes | unknown | 2024-05-15 to 2049-05-15 | - | - | - | clean |
| 13 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS ECC CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 14 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS RSA CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 15 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod TLS ECC CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 16 | countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod TLS RSA CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 17 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 18 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL Pro ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 19 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL Pro RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 20 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 21 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Code Signing ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1 | 0 | Code Signing | clean |
| 22 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Code Signing RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1 | 0 | Code Signing | clean |
| 23 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Code Signing RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1 | 0 | Code Signing | clean |
| 24 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS ECC CA 2024 | yes | current | 2024-05-15 to 2044-05-15 | 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 25 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS RSA CA 2024 | yes | current | 2024-05-15 to 2044-05-15 | 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 26 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Document Signing ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 27 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Document Signing RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 28 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Document Signing RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 29 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS ECC CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 30 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS ECC CA 2024 | yes | current | 2024-05-15 to 2034-05-15 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 31 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 32 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 33 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA 2024 | yes | current | 2024-05-15 to 2034-05-15 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 34 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 35 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV Code Signing ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2 | 0 | Code Signing | clean |
| 36 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV Code Signing RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2 | 0 | Code Signing | clean |
| 37 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV Code Signing RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2 | 0 | Code Signing | clean |
| 38 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 39 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA 2024 | yes | revoked | 2024-05-15 to 2034-05-15 | 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 40 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA 2024 V2 | yes | current | 2024-07-18 to 2034-07-18 | 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 41 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 42 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 43 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA 2024 | yes | revoked | 2024-05-15 to 2034-05-15 | 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 44 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA 2024 V2 | yes | current | 2024-07-18 to 2034-07-18 | 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 45 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 46 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 47 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA 2024 | yes | current | 2024-05-15 to 2034-05-15 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 48 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 49 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 50 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA 2024 | yes | current | 2024-05-15 to 2034-05-15 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 51 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, TLS Web Server Authentication | clean |
| 52 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Secure Email ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 53 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Secure Email RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 54 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Secure Email RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12 | clean |
| 55 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME ECC CA 2024 | yes | current | 2024-05-15 to 2034-05-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 56 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME RSA CA 2024 | yes | current | 2024-05-15 to 2034-05-15 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 57 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TimeStamping ECC CA G4 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 58 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TimeStamping RSA CA | yes | current | 2020-08-27 to 2040-08-26 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 59 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TimeStamping RSA CA G3 | yes | current | 2021-05-20 to 2041-05-19 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 60 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA ECC CA 2024 | yes | current | 2024-05-15 to 2044-05-15 | 2.23.140.1.4.2 | 0 | Time Stamping | clean |
| 61 | countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA RSA CA 2024 | yes | current | 2024-05-15 to 2044-05-15 | 2.23.140.1.4.2 | 0 | Time Stamping | clean |
| 62 | countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom DV TLS ECC CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 63 | countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom DV TLS RSA CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 64 | countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom TLS ECC CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 65 | countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom TLS RSA CA 2026 | yes | current | 2026-04-28 to 2029-04-28 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |
| 66 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet DV TLS ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 67 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet DV TLS RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 68 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet EV TLS ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 69 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet EV TLS RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1 | 0 | TLS Web Server Authentication | clean |
| 70 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet OV TLS ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 71 | countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet OV TLS RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 72 | countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 DV TLS ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 73 | countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 DV TLS RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 74 | countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 TLS ECC CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | current errors: 1 |
| 75 | countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 TLS RSA CA 2025 | yes | current | 2025-10-21 to 2030-10-21 | 2.5.29.32.0 | 0 | TLS Web Server Authentication | clean |

## Certificate Details

### TrustAsia CS ECC Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS ECC Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS ECC Root CA
- Serial: 638B543371ADE3CE9DE38FB5B25092EC0160737A
- SHA-256: 6B9C91E5A6453375EF905D8F2A5369953065F471664F2E676E2013DF388C9B56
- SPKI SHA-256: DA54D583FED8081ADE0228C0F91D742CCFE36689134568C8834C452DB724A813
- Validity: 2024-05-15 to 2049-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCSECCRootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:8b:54:33:71:ad:e3:ce:9d:e3:8f:b5:b2:50:92:ec:01:60:73:7a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS ECC Root CA
        Validity
            Not Before: May 15 05:42:02 2024 GMT
            Not After : May 15 05:42:01 2049 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                5D:87:5E:B4:8E:96:79:5E:B5:34:A5:42:B1:C3:79:8F:73:5D:EF:4B
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6B9C91E5A6453375EF905D8F2A5369953065F471664F2E676E2013DF388C9B56
    SPKI SHA256: DA54D583FED8081ADE0228C0F91D742CCFE36689134568C8834C452DB724A813
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia CS RSA Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS RSA Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS RSA Root CA
- Serial: 7F2BE4269A8F603D593982100EEE4270440EA848
- SHA-256: F38AB64B30C0D900B7212A793651B87F287C575224007F3B8851618FD5B48DEB
- SPKI SHA-256: 6B8118C41374425F232E9ADFF82A1594739DFF43C891DC1704A85AE07CC73F3C
- Validity: 2024-05-15 to 2049-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCSRSARootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:2b:e4:26:9a:8f:60:3d:59:39:82:10:0e:ee:42:70:44:0e:a8:48
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS RSA Root CA
        Validity
            Not Before: May 15 05:42:04 2024 GMT
            Not After : May 15 05:42:03 2049 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B1:2E:11:46:6A:82:33:9C:D3:F2:F0:01:85:29:A6:07:B7:92:A7:9E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F38AB64B30C0D900B7212A793651B87F287C575224007F3B8851618FD5B48DEB
    SPKI SHA256: 6B8118C41374425F232E9ADFF82A1594739DFF43C891DC1704A85AE07CC73F3C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia Global Root CA G1

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 7D9234E348EC8C91B7BBDD5A1A49FBEC06DFDDBB
- SHA-256: 05F82DE4B4A9ED4B7CD1F3ACE9B73BD6DB69D87816DD3847195CF737ED2951E7
- SPKI SHA-256: 5F3D96861F93BEE6C0B639B417F69D81CEE305886F5490E8B8A9E8AB55A4959D
- Validity: 2020-08-27 to 2045-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d21a17b2-b089-4847-a9c6-f55239f76ed1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6fccae8-47f1-41da-a597-49f608d96ae7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a8e69828-d765-4fe1-81e9-15971621c7e2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c1171bd1-4f04-4c3a-bb92-ef85f5e74573, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=ddc533c8-15c4-4789-abeb-9f5f10c7ac2d, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=94d668c8-939e-420d-9684-744f0831295e
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:92:34:e3:48:ec:8c:91:b7:bb:dd:5a:1a:49:fb:ec:06:df:dd:bb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 05:45:51 2020 GMT
            Not After : Aug 26 05:45:51 2045 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            X509v3 Subject Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 05F82DE4B4A9ED4B7CD1F3ACE9B73BD6DB69D87816DD3847195CF737ED2951E7
    SPKI SHA256: 5F3D96861F93BEE6C0B639B417F69D81CEE305886F5490E8B8A9E8AB55A4959D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia Global Root CA G2

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G2
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G2
- Serial: 723E1D3A04046D0CB8C8158B6E626A05E005E761
- SHA-256: 1DF7E8B185CA46578D458D05129854FDE32EF1E9B36F0B96963CE38CAEABE4BC
- SPKI SHA-256: 22BC90D048112F636788D901D8A1530BE888A8E3AC45103F44486B292C5CC97F
- Validity: 2020-08-27 to 2045-08-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=d21a17b2-b089-4847-a9c6-f55239f76ed1, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=e6fccae8-47f1-41da-a597-49f608d96ae7, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a8e69828-d765-4fe1-81e9-15971621c7e2, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=c1171bd1-4f04-4c3a-bb92-ef85f5e74573
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:3e:1d:3a:04:04:6d:0c:b8:c8:15:8b:6e:62:6a:05:e0:05:e7:61
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G2
        Validity
            Not Before: Aug 27 05:45:54 2020 GMT
            Not After : Aug 26 05:45:54 2045 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                4F:EB:29:96:F4:F1:42:DE:5A:A2:07:56:B2:FF:59:C2:85:3E:C3:98
            X509v3 Subject Key Identifier:
                4F:EB:29:96:F4:F1:42:DE:5A:A2:07:56:B2:FF:59:C2:85:3E:C3:98
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 1DF7E8B185CA46578D458D05129854FDE32EF1E9B36F0B96963CE38CAEABE4BC
    SPKI SHA256: 22BC90D048112F636788D901D8A1530BE888A8E3AC45103F44486B292C5CC97F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia Global Root CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 64F60E6577616AAB3BB4EA8584BBB189B871930F
- SHA-256: E0D3226AEB1163C2E48FF9BE3B50B4C6431BE7BB1EACC5C36B5D5EC509039A08
- SPKI SHA-256: 8685AD850F7F56CD16943BCB70B434E7356E1B8BDC613406E2EA8DE46092B636
- Validity: 2021-05-20 to 2046-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=498e7db8-79f0-4ffc-acf8-66a80932b53b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:f6:0e:65:77:61:6a:ab:3b:b4:ea:85:84:bb:b1:89:b8:71:93:0f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 02:10:19 2021 GMT
            Not After : May 19 02:10:19 2046 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            X509v3 Subject Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E0D3226AEB1163C2E48FF9BE3B50B4C6431BE7BB1EACC5C36B5D5EC509039A08
    SPKI SHA256: 8685AD850F7F56CD16943BCB70B434E7356E1B8BDC613406E2EA8DE46092B636
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia Global Root CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 4F2364B88E97639EC65381C1764ECB2A7415D6D7
- SHA-256: BE4B56CB5056C0136A526DF444508DAA36A0B54F42E4AC38F72AF470E479654C
- SPKI SHA-256: 07A2904D4BFF9604EA1331AE990E9FFE331232E69ECB8A08CD49D8E34757DB41
- Validity: 2021-05-20 to 2046-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=498e7db8-79f0-4ffc-acf8-66a80932b53b, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:23:64:b8:8e:97:63:9e:c6:53:81:c1:76:4e:cb:2a:74:15:d6:d7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 02:10:22 2021 GMT
            Not After : May 19 02:10:22 2046 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            X509v3 Subject Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BE4B56CB5056C0136A526DF444508DAA36A0B54F42E4AC38F72AF470E479654C
    SPKI SHA256: 07A2904D4BFF9604EA1331AE990E9FFE331232E69ECB8A08CD49D8E34757DB41
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia SMIME ECC Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME ECC Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME ECC Root CA
- Serial: 5AC2F8294FE37DC55E1D186F3B93201FFF7BBA2D
- SHA-256: 436472C1009A325C54F1A5BBB5468A7BAEECCBE05DE5F099CB70D3FE41E13C16
- SPKI SHA-256: 74D34EBB2D1A9E9390FEA49EA9F8056C8D8E15D117B652F3C1C860856AF2B328
- Validity: 2024-05-15 to 2044-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=498e7db8-79f0-4ffc-acf8-66a80932b53b
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSMIMEECCRootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:c2:f8:29:4f:e3:7d:c5:5e:1d:18:6f:3b:93:20:1f:ff:7b:ba:2d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME ECC Root CA
        Validity
            Not Before: May 15 05:41:59 2024 GMT
            Not After : May 15 05:41:58 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                31:67:E6:72:B2:0D:E6:22:A0:AC:CF:7E:22:A7:59:32:E3:66:23:A5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 436472C1009A325C54F1A5BBB5468A7BAEECCBE05DE5F099CB70D3FE41E13C16
    SPKI SHA256: 74D34EBB2D1A9E9390FEA49EA9F8056C8D8E15D117B652F3C1C860856AF2B328
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia SMIME RSA Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME RSA Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME RSA Root CA
- Serial: 5AEE71DFDE0C5785B5BB3622D7B876460273CAFF
- SHA-256: C7796BEB62C101BB143D262A7C96A0C6168183223EF50D699632D86E03B8CC9B
- SPKI SHA-256: CB46EB71247E6A463EE57C56EF148C64F537A898294828FDCC66183266E08ACA
- Validity: 2024-05-15 to 2044-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=498e7db8-79f0-4ffc-acf8-66a80932b53b
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSMIMERSARootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:ee:71:df:de:0c:57:85:b5:bb:36:22:d7:b8:76:46:02:73:ca:ff
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME RSA Root CA
        Validity
            Not Before: May 15 05:42:01 2024 GMT
            Not After : May 15 05:42:00 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                80:1A:AA:43:C1:C9:7F:8B:1A:96:45:BC:3D:BB:6B:48:52:6C:5B:AB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C7796BEB62C101BB143D262A7C96A0C6168183223EF50D699632D86E03B8CC9B
    SPKI SHA256: CB46EB71247E6A463EE57C56EF148C64F537A898294828FDCC66183266E08ACA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia TLS ECC Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 3674E14D7C6513C9AC835525A03E527E2F5068C7
- SHA-256: C0076B9EF0531FB1A656D67C4EBE97CD5DBAA41EF44598ACC2489878C92D8711
- SPKI SHA-256: F4632E58701C0BD7DAFC7E3831355EC433FC13777DE286683E8EC50964DF0452
- Validity: 2024-05-15 to 2044-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl, http://crl.litessl.com/TrustAsiaTLSECCRootCA.crl, http://crl-pro.litessl.com/TrustAsiaTLSECCRootCA.crl, http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Not Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:74:e1:4d:7c:65:13:c9:ac:83:55:25:a0:3e:52:7e:2f:50:68:c7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: May 15 05:41:56 2024 GMT
            Not After : May 15 05:41:55 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C0076B9EF0531FB1A656D67C4EBE97CD5DBAA41EF44598ACC2489878C92D8711
    SPKI SHA256: F4632E58701C0BD7DAFC7E3831355EC433FC13777DE286683E8EC50964DF0452
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia TLS RSA Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 1C18D8CFE5533F2235465354243C6C47D15C4A9C
- SHA-256: 06C08D7DAFD876971EB1124FE67F847EC0C7A158D3EA53CBE940E2EA9791F4C3
- SPKI SHA-256: 5628872E245FE66148B80BADEAC9C40F6252E642FA9595AECE4B3E8A58B8FD46
- Validity: 2024-05-15 to 2044-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=76914bf6-9b3a-4c5f-b739-419a1152c6ca, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=411bce13-7fd2-46bf-a31b-b3cec80e9ff9
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl, http://crl.litessl.com/TrustAsiaTLSRSARootCA.crl, http://crl-pro.litessl.com/TrustAsiaTLSRSARootCA.crl, http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Included","microsoft":"Not Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:18:d8:cf:e5:53:3f:22:35:46:53:54:24:3c:6c:47:d1:5c:4a:9c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: May 15 05:41:57 2024 GMT
            Not After : May 15 05:41:56 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 06C08D7DAFD876971EB1124FE67F847EC0C7A158D3EA53CBE940E2EA9791F4C3
    SPKI SHA256: 5628872E245FE66148B80BADEAC9C40F6252E642FA9595AECE4B3E8A58B8FD46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia TSA ECC Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA ECC Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA ECC Root CA
- Serial: 3EE6CBD954FC98E0D1CB43103B24B6E47DAF1FFD
- SHA-256: 2E04BF6C4C91864389F7CB30AFF4B54346794EF897B0D6557F10B7A8BA6D932C
- SPKI SHA-256: 529FFA2DA93AC8AEE3C64D60A690F552A351604F2E3B9B96E46801045083FBFF
- Validity: 2024-05-15 to 2049-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTSAECCRootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:e6:cb:d9:54:fc:98:e0:d1:cb:43:10:3b:24:b6:e4:7d:af:1f:fd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA ECC Root CA
        Validity
            Not Before: May 15 05:42:05 2024 GMT
            Not After : May 15 05:42:04 2049 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA ECC Root CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                25:A6:6C:22:F3:80:04:26:63:33:6C:FD:25:A4:1E:47:34:FD:FB:6E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2E04BF6C4C91864389F7CB30AFF4B54346794EF897B0D6557F10B7A8BA6D932C
    SPKI SHA256: 529FFA2DA93AC8AEE3C64D60A690F552A351604F2E3B9B96E46801045083FBFF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### TrustAsia TSA RSA Root CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA RSA Root CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA RSA Root CA
- Serial: 1AE5D0AD693D1029A55F74343E98CB40192DF3BF
- SHA-256: 1498BFED947C795235D3482FBE493CD89BE5DC0747291C716360356E89D4595E
- SPKI SHA-256: 95CBA13157A5B57BCA6BFA2944DE9B1B121DB713F1C14BBA91B8203D46F8F4A1
- Validity: 2024-05-15 to 2049-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.trustasia.com/repo/cps/TrustAsia-Global-CP-CPS_EN_V2.1.3.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=232d854a-3ab9-45f9-b85d-21b0e9221e14, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=502c0aa5-0649-452f-ab45-eea59a6a07cd, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=b34f86a5-2c2d-485b-8e11-3e5518a7059f
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTSARSARootCA.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Not Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:e5:d0:ad:69:3d:10:29:a5:5f:74:34:3e:98:cb:40:19:2d:f3:bf
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA RSA Root CA
        Validity
            Not Before: May 15 05:42:07 2024 GMT
            Not After : May 15 05:42:06 2049 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA RSA Root CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                38:DC:70:12:94:44:CD:6C:20:5E:3F:D2:6A:E5:A4:B3:F9:EF:AF:A0
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1498BFED947C795235D3482FBE493CD89BE5DC0747291C716360356E89D4595E
    SPKI SHA256: 95CBA13157A5B57BCA6BFA2944DE9B1B121DB713F1C14BBA91B8203D46F8F4A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### DNSPod DV TLS ECC CA 2026

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 23E6D5B1118F3AE6728F01713791D623FA1F9E32
- SHA-256: 84347140085D4BBBFC42AAAFA211E5B5987E4E8C7490C25103D25EFEFA46CC1D
- SPKI SHA-256: 7A3A6D30FA486415F80AF740B8B0EE6514EB7003D47584A139C830B7B6BA41D7
- Validity: 2026-04-28 to 2029-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/DNSPodDVTLSECCCA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:e6:d5:b1:11:8f:3a:e6:72:8f:01:71:37:91:d6:23:fa:1f:9e:32
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Apr 28 05:32:18 2026 GMT
            Not After : Apr 28 05:32:17 2029 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod DV TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                99:05:4A:D0:F5:91:3C:71:DF:DB:47:78:27:A2:B0:EE:4D:1A:E7:E7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 84347140085D4BBBFC42AAAFA211E5B5987E4E8C7490C25103D25EFEFA46CC1D
    SPKI SHA256: 7A3A6D30FA486415F80AF740B8B0EE6514EB7003D47584A139C830B7B6BA41D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod DV TLS RSA CA 2026

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod DV TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 0F0509247F9D0E189A6BBAF29C6C4F0DB356B6D9
- SHA-256: 6B899E85B85932C3BDE04CD2B35365B7BD1950F318B0C32079373EF98B62422E
- SPKI SHA-256: 55D6407ABD361648B8FAFBFFEF02EA0CF6E17E524E13C91B1BD141A6609F90BD
- Validity: 2026-04-28 to 2029-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/DNSPodDVTLSRSACA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0f:05:09:24:7f:9d:0e:18:9a:6b:ba:f2:9c:6c:4f:0d:b3:56:b6:d9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Apr 28 05:32:14 2026 GMT
            Not After : Apr 28 05:32:13 2029 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod DV TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                DB:C2:CF:46:97:25:81:09:71:A1:51:DF:79:1D:B2:6F:BB:C8:C9:D7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6B899E85B85932C3BDE04CD2B35365B7BD1950F318B0C32079373EF98B62422E
    SPKI SHA256: 55D6407ABD361648B8FAFBFFEF02EA0CF6E17E524E13C91B1BD141A6609F90BD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod TLS ECC CA 2026

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 5515438C053A00425D907AA310471F8B24D7C907
- SHA-256: 451B60A00619EE05A44CD0B16503E190256D525B61A8DCED14117330EAE6F8DB
- SPKI SHA-256: F94918CA79A56EA8F3571CB50562381F8AB02692D5B22B74463BDB9F067663C8
- Validity: 2026-04-28 to 2029-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/DNSPodTLSECCCA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:15:43:8c:05:3a:00:42:5d:90:7a:a3:10:47:1f:8b:24:d7:c9:07
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Apr 28 05:32:25 2026 GMT
            Not After : Apr 28 05:32:24 2029 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                31:30:7A:27:BD:FA:64:38:A3:36:3F:3C:81:25:E2:DC:86:D0:7B:D9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 451B60A00619EE05A44CD0B16503E190256D525B61A8DCED14117330EAE6F8DB
    SPKI SHA256: F94918CA79A56EA8F3571CB50562381F8AB02692D5B22B74463BDB9F067663C8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### DNSPod TLS RSA CA 2026

- Subject: countryName=CN, organizationName=DNSPod, Inc., commonName=DNSPod TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 1DBAC583E80D55D64919FA31425F5C5EB5121EC4
- SHA-256: FD73D219CF20DA8B236FA8B8F181E584EC17D91DA4FEF6FA0B51ED7B107A666A
- SPKI SHA-256: 8E36CA282A37D7FD52686DC0CE47AF951C90C505DE5FD4913B882705A3574167
- Validity: 2026-04-28 to 2029-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/DNSPodTLSRSACA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1d:ba:c5:83:e8:0d:55:d6:49:19:fa:31:42:5f:5c:5e:b5:12:1e:c4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Apr 28 05:32:21 2026 GMT
            Not After : Apr 28 05:32:20 2029 GMT
        Subject: C = CN, O = "DNSPod, Inc.", CN = DNSPod TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                C3:FB:C1:A2:81:50:FD:10:4E:65:EA:93:82:C6:B9:D1:FC:9F:A0:34
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FD73D219CF20DA8B236FA8B8F181E584EC17D91DA4FEF6FA0B51ED7B107A666A
    SPKI SHA256: 8E36CA282A37D7FD52686DC0CE47AF951C90C505DE5FD4913B882705A3574167
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LiteSSL ECC CA 2025

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 4599BCDD69247A9B70ACCFFB4D26743E5B20729B
- SHA-256: 86C2A5EFB7A5C8D2C7654160F0C19EEAAA0E6AE43B249F0C4D17024CDC7D2939
- SPKI SHA-256: B693A01492ED766790D2C9ECBDFEAC1145B87EDDC4B7DB9E7421412599631698
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.litessl.com/LiteSSLECCCA2025-Part.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part1.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part2.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part3.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part4.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part5.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part6.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part7.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part8.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part9.crl, http://crl.litessl.com/LiteSSLECCCA2025-Part10.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.litessl.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            45:99:bc:dd:69:24:7a:9b:70:ac:cf:fb:4d:26:74:3e:5b:20:72:9b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:08:18 2025 GMT
            Not After : Oct 21 06:08:17 2030 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = LiteSSL ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.litessl.com/TrustAsiaTLSECCRootCA.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.litessl.com/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                64:C2:94:1F:5B:76:BA:03:B7:30:74:9E:64:F3:E3:FA:BB:0C:30:E3
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 86C2A5EFB7A5C8D2C7654160F0C19EEAAA0E6AE43B249F0C4D17024CDC7D2939
    SPKI SHA256: B693A01492ED766790D2C9ECBDFEAC1145B87EDDC4B7DB9E7421412599631698
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://ica.litessl.com/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.litessl.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### LiteSSL Pro ECC CA 2025

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL Pro ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 72AAEAC402A0626F455A6AA550ADD6E07008F64E
- SHA-256: EF727545CA777621BA1707BA3BF15890ED123B088DC3384C2097871BF85FAE00
- SPKI SHA-256: 62EA6DB2F646D29206E6761BD4480FCF6823A77489F0CEDDEE4164AE819590AD
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part1.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part2.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part3.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part4.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part5.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part6.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part7.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part8.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part9.crl, http://crl-pro.litessl.com/LiteSSLProECCCA2025-Part10.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp-pro.litessl.com/TrustAsiaTLSECCRootCA
- CRL DP: http://crl-pro.litessl.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:aa:ea:c4:02:a0:62:6f:45:5a:6a:a5:50:ad:d6:e0:70:08:f6:4e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:08:22 2025 GMT
            Not After : Oct 21 06:08:21 2030 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = LiteSSL Pro ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica-pro.litessl.com/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp-pro.litessl.com/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-pro.litessl.com/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                69:31:E8:13:8B:62:EF:B2:08:2D:7B:0F:0C:B3:20:4F:3A:FB:0A:88
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EF727545CA777621BA1707BA3BF15890ED123B088DC3384C2097871BF85FAE00
    SPKI SHA256: 62EA6DB2F646D29206E6761BD4480FCF6823A77489F0CEDDEE4164AE819590AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp-pro.litessl.com/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica-pro.litessl.com/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl-pro.litessl.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LiteSSL Pro RSA CA 2025

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL Pro RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 4440D2F8E69BD27E382F99D15C77DABF05AEF42D
- SHA-256: 493582B1DEE123195F9C50B17697C56AC468747D5FE60E6C25AC739DBE5C2A97
- SPKI SHA-256: F82C968A110DB6E7F3BEECDDBD338570B83552E43FBF4B559BC3D86405088FB6
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part1.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part2.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part3.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part4.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part5.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part6.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part7.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part8.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part9.crl, http://crl-pro.litessl.com/LiteSSLProRSACA2025-Part10.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp-pro.litessl.com/TrustAsiaTLSRSARootCA
- CRL DP: http://crl-pro.litessl.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:40:d2:f8:e6:9b:d2:7e:38:2f:99:d1:5c:77:da:bf:05:ae:f4:2d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:13:54 2025 GMT
            Not After : Oct 21 06:13:53 2030 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = LiteSSL Pro RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica-pro.litessl.com/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp-pro.litessl.com/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl-pro.litessl.com/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                A9:2C:72:F2:0D:15:9B:19:F8:C9:63:D4:2E:35:5B:C6:52:1F:E1:3D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 493582B1DEE123195F9C50B17697C56AC468747D5FE60E6C25AC739DBE5C2A97
    SPKI SHA256: F82C968A110DB6E7F3BEECDDBD338570B83552E43FBF4B559BC3D86405088FB6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp-pro.litessl.com/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica-pro.litessl.com/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl-pro.litessl.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### LiteSSL RSA CA 2025

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=LiteSSL RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 2CE54B63F5E07B62F6BA869622995DADF627F82E
- SHA-256: AD4DF1416B387E6ABBF8612B5807C2A2B404F6AA3AA50EAB360FDE30EB6F0F11
- SPKI SHA-256: 5ADD990BE204DC2A5FEA145F9689079F1C9947E643F364EA1648F5FDF9989DD7
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.litessl.com/LiteSSLRSACA2025-Part.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part1.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part2.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part3.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part4.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part5.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part6.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part7.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part8.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part9.crl, http://crl.litessl.com/LiteSSLRSACA2025-Part10.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: http://crl.litessl.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:e5:4b:63:f5:e0:7b:62:f6:ba:86:96:22:99:5d:ad:f6:27:f8:2e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:08:38 2025 GMT
            Not After : Oct 21 06:08:37 2030 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = LiteSSL RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.litessl.com/TrustAsiaTLSRSARootCA.crt
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.litessl.com/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                7D:57:8B:96:24:D6:2E:78:04:DC:27:AC:6A:44:BD:7B:A4:1F:7F:B5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: AD4DF1416B387E6ABBF8612B5807C2A2B404F6AA3AA50EAB360FDE30EB6F0F11
    SPKI SHA256: 5ADD990BE204DC2A5FEA145F9689079F1C9947E643F364EA1648F5FDF9989DD7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: -
- AIA CA Issuers: http://ica.litessl.com/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.litessl.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_aia_ca_issuers

### TrustAsia Code Signing ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Code Signing ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 055D734B5298803D8E04464F69DD95E2C1D2B328
- SHA-256: 933ECE2B4EBB0557072C7B408F6D36A540524C3D1A60F260C97D9629D060BA7B
- SPKI SHA-256: 911D4437AC58CD45B09F47AE315E8BA0C3218B3A77E09C66C2998017D99D4DA7
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCodeSigningECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:5d:73:4b:52:98:80:3d:8e:04:46:4f:69:dd:95:e2:c1:d2:b3:28
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Code Signing ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.44494.2.2.1
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                FB:75:14:C9:DD:35:A7:00:3A:3C:13:54:25:9B:FD:DE:3F:02:DC:F6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 933ECE2B4EBB0557072C7B408F6D36A540524C3D1A60F260C97D9629D060BA7B
    SPKI SHA256: 911D4437AC58CD45B09F47AE315E8BA0C3218B3A77E09C66C2998017D99D4DA7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Code Signing RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Code Signing RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 6BE42A18C2BC07A9F44573DC28CF11CFC3FBEE80
- SHA-256: 4A14A381B9F2E7A7A49EFA3A87360DB433C6DAF7B80E06F67572EA8924375B60
- SPKI SHA-256: 28DD084DDAF3CF91BBA4FA2C8F65FB51628722313B0BBC79EE50960CF4CE9997
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCodeSigningRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:e4:2a:18:c2:bc:07:a9:f4:45:73:dc:28:cf:11:cf:c3:fb:ee:80
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Code Signing RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.44494.2.2.1
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                F1:EC:AF:24:AA:AE:E1:F2:95:8F:17:2A:B8:38:B9:F8:6F:C3:94:B9
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4A14A381B9F2E7A7A49EFA3A87360DB433C6DAF7B80E06F67572EA8924375B60
    SPKI SHA256: 28DD084DDAF3CF91BBA4FA2C8F65FB51628722313B0BBC79EE50960CF4CE9997
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Code Signing RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Code Signing RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 71B964D59320CC2AD1B7AF5E1865BFEDB40E8736
- SHA-256: FA012B12A453DAF7C02BD7F8FF617A4C91EB2953D3E42F6FDB000EAE4FB6FAAE
- SPKI SHA-256: AFCD988F5972651F0CEF956892E771A0E9B9850638E071850CFD1729327A8EF6
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCodeSigningRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            71:b9:64:d5:93:20:cc:2a:d1:b7:af:5e:18:65:bf:ed:b4:0e:87:36
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Code Signing RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.1
                Policy: 1.3.6.1.4.1.44494.2.2.1
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                A3:ED:9A:5F:E3:DF:E8:CE:6A:B4:1E:C6:3C:62:5F:DC:AC:9A:06:82
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: FA012B12A453DAF7C02BD7F8FF617A4C91EB2953D3E42F6FDB000EAE4FB6FAAE
    SPKI SHA256: AFCD988F5972651F0CEF956892E771A0E9B9850638E071850CFD1729327A8EF6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1, 1.3.6.1.4.1.44494.2.2.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia CS ECC CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS ECC CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS ECC Root CA
- Serial: 5939C7235F8E877E9595A3FB188B4BE14336C223
- SHA-256: 5CF4B9BC8D9BA4A96DE8BC3B5C38D0372B0A0187DD1A9AE985647A81F077610B
- SPKI SHA-256: FC9D7A2235524B2A10BFF63BB3AD45918813D39E25C1DA64CDB6B2AD47A27380
- Validity: 2024-05-15 to 2044-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCSECCCA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaCSECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaCSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:39:c7:23:5f:8e:87:7e:95:95:a3:fb:18:8b:4b:e1:43:36:c2:23
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS ECC Root CA
        Validity
            Not Before: May 15 06:19:27 2024 GMT
            Not After : May 15 06:19:26 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                5D:87:5E:B4:8E:96:79:5E:B5:34:A5:42:B1:C3:79:8F:73:5D:EF:4B
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaCSECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaCSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.1
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaCSECCRootCA.crl
            X509v3 Subject Key Identifier:
                70:8C:1F:D8:C6:B1:AA:07:38:7B:A7:8F:3B:AA:23:03:99:AE:53:C1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5CF4B9BC8D9BA4A96DE8BC3B5C38D0372B0A0187DD1A9AE985647A81F077610B
    SPKI SHA256: FC9D7A2235524B2A10BFF63BB3AD45918813D39E25C1DA64CDB6B2AD47A27380
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaCSECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaCSECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaCSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia CS RSA CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS RSA CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia CS RSA Root CA
- Serial: 653D62F6CE586418AC614F204B96F1D91CC098FF
- SHA-256: 0C67D64F6430F927EB3772677ADFC5C236A14E3DF7A766BFF299FB7EAB1EF315
- SPKI SHA-256: 1DFC4FBABCA151318318B4DC9A4527716E28CAE585D784C21C15E2F0C3EC264E
- Validity: 2024-05-15 to 2044-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaCSRSACA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaCSRSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaCSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:3d:62:f6:ce:58:64:18:ac:61:4f:20:4b:96:f1:d9:1c:c0:98:ff
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS RSA Root CA
        Validity
            Not Before: May 15 06:19:31 2024 GMT
            Not After : May 15 06:19:30 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia CS RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B1:2E:11:46:6A:82:33:9C:D3:F2:F0:01:85:29:A6:07:B7:92:A7:9E
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaCSRSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaCSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.1
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaCSRSARootCA.crl
            X509v3 Subject Key Identifier:
                7E:B2:52:9B:31:F4:F4:B4:F7:D5:BE:0F:83:10:28:CD:68:C0:8A:AE
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0C67D64F6430F927EB3772677ADFC5C236A14E3DF7A766BFF299FB7EAB1EF315
    SPKI SHA256: 1DFC4FBABCA151318318B4DC9A4527716E28CAE585D784C21C15E2F0C3EC264E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.4.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaCSRSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaCSRSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaCSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Document Signing ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Document Signing ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 6FCFBE1088ADFE84E24A75AB3AFE75392B6E29AE
- SHA-256: 84598841793B351DD3AD8C11A521CAD00270CF64663C80002A025572F8020792
- SPKI SHA-256: 7E728875A08007C261D6FE2E022A4A64056E5362075912C56CBA9265344FD6BA
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDocumentSigningECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6f:cf:be:10:88:ad:fe:84:e2:4a:75:ab:3a:fe:75:39:2b:6e:29:ae
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Document Signing ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                DE:A9:70:A2:2D:B3:55:72:EB:58:49:77:65:3F:23:47:9C:4F:74:A1
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 84598841793B351DD3AD8C11A521CAD00270CF64663C80002A025572F8020792
    SPKI SHA256: 7E728875A08007C261D6FE2E022A4A64056E5362075912C56CBA9265344FD6BA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Document Signing RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Document Signing RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 47BBA7C1DFB66F2A722DB77567CC1722B79D9D3F
- SHA-256: 033C44B6C711CA26E7B5ABFD36B72110F5944146D99E92C020266B90FDD766A6
- SPKI SHA-256: 732DD3B4497317CDD67EC8E71DF448C2DD0A4BD6E65D60F64CC22C59C097A24D
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDocumentSigningRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bb:a7:c1:df:b6:6f:2a:72:2d:b7:75:67:cc:17:22:b7:9d:9d:3f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Document Signing RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                68:75:2D:EB:63:5A:C8:81:EF:C2:68:43:0C:F2:15:C5:56:4D:63:E5
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 033C44B6C711CA26E7B5ABFD36B72110F5944146D99E92C020266B90FDD766A6
    SPKI SHA256: 732DD3B4497317CDD67EC8E71DF448C2DD0A4BD6E65D60F64CC22C59C097A24D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Document Signing RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Document Signing RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 44CAF2E088869D1C9139BA93DF0637781C5F3B02
- SHA-256: B7DE90291B7905CBDB8C744E98F1E6FC97C2288B2177F79D916D18D31AE8B2A7
- SPKI SHA-256: 35285760D3FCC8391A18370EACF2DA856E6226AD9366F7B904CD4A5851DCCCE7
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDocumentSigningRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            44:ca:f2:e0:88:86:9d:1c:91:39:ba:93:df:06:37:78:1c:5f:3b:02
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Document Signing RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                05:21:A5:08:83:37:56:45:B4:05:5F:1B:6D:20:61:27:D8:5E:81:43
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B7DE90291B7905CBDB8C744E98F1E6FC97C2288B2177F79D916D18D31AE8B2A7
    SPKI SHA256: 35285760D3FCC8391A18370EACF2DA856E6226AD9366F7B904CD4A5851DCCCE7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV TLS ECC CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS ECC CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G2
- Serial: 37884F00D6FB4304B9BC7F394FCC07F286BC6520
- SHA-256: C3D06E5271233ED46A538C150FDCDCD73F88AECEF624B8D16F981C13742E924D
- SPKI SHA-256: 2C540C495CE6EF627F9C0DD4E56FA00736CD9A1EBA22EB3FBECBE09DE8034815
- Validity: 2020-08-27 to 2040-08-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDVTLSECCCA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            37:88:4f:00:d6:fb:43:04:b9:bc:7f:39:4f:cc:07:f2:86:bc:65:20
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G2
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS ECC CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                4F:EB:29:96:F4:F1:42:DE:5A:A2:07:56:B2:FF:59:C2:85:3E:C3:98
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
            X509v3 Subject Key Identifier:
                C1:2D:72:D0:E8:92:5B:19:60:52:C0:DC:EE:6A:73:4D:21:19:17:06
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C3D06E5271233ED46A538C150FDCDCD73F88AECEF624B8D16F981C13742E924D
    SPKI SHA256: 2C540C495CE6EF627F9C0DD4E56FA00736CD9A1EBA22EB3FBECBE09DE8034815
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV TLS ECC CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS ECC CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 82B478393BA4D322AEDA6FE6224B0BFBE225E8
- SHA-256: 73E9BE7D57BD5C72A06304463D32F8F85ECA12E2F2D284E48AE83F653FDB4EB6
- SPKI SHA-256: 77C590F4E932AE6816AB36D0B10925E6E2FEB9EEDFF430847687095294739C61
- Validity: 2024-05-15 to 2034-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDVTLSECCCA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            82:b4:78:39:3b:a4:d3:22:ae:da:6f:e6:22:4b:0b:fb:e2:25:e8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: May 15 06:19:11 2024 GMT
            Not After : May 15 06:19:10 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                D0:B7:0C:ED:FC:54:02:C2:C0:5D:7E:3B:17:EB:BF:10:50:B1:96:65
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 73E9BE7D57BD5C72A06304463D32F8F85ECA12E2F2D284E48AE83F653FDB4EB6
    SPKI SHA256: 77C590F4E932AE6816AB36D0B10925E6E2FEB9EEDFF430847687095294739C61
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV TLS ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 0FF8C00514BBA2C3A6FE4FC96868B99F3D303F7B
- SHA-256: C28348740DA36CF14DDC49280CF030AB9CE3B0ACE093B0E1BA189456F4918B9C
- SPKI SHA-256: 47EB3491D9BC1336853B72E2CB0DDB26AB47037C86EFE886CE108C2A094D1716
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDVTLSECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0f:f8:c0:05:14:bb:a2:c3:a6:fe:4f:c9:68:68:b9:9f:3d:30:3f:7b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                0C:09:D7:41:BD:F0:4C:B7:67:E4:B0:56:BF:7E:8D:B9:14:33:32:2F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C28348740DA36CF14DDC49280CF030AB9CE3B0ACE093B0E1BA189456F4918B9C
    SPKI SHA256: 47EB3491D9BC1336853B72E2CB0DDB26AB47037C86EFE886CE108C2A094D1716
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV TLS RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 732361AEB50C736E09207AA38B1EA36AD9096E61
- SHA-256: 322C1AFDCC9827AC4D234780082A9862034941998AFF67E6D77BC4C560DB25B4
- SPKI SHA-256: 854F3E8E7BC44E1AB263E18A9FF46BFCBBBEA1E8D63323FECC7ED2B54F04E0BB
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDVTLSRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:23:61:ae:b5:0c:73:6e:09:20:7a:a3:8b:1e:a3:6a:d9:09:6e:61
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                BF:3F:DE:D0:46:6D:4A:50:CF:E2:FB:E2:0B:85:48:34:C1:AF:B8:25
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 322C1AFDCC9827AC4D234780082A9862034941998AFF67E6D77BC4C560DB25B4
    SPKI SHA256: 854F3E8E7BC44E1AB263E18A9FF46BFCBBBEA1E8D63323FECC7ED2B54F04E0BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV TLS RSA CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 1C9E6B412DEB0A85461DE03DBE30984D0573888B
- SHA-256: 5EB0217B928C2DE1170FCE110CACC3C89A42492E4F97F5AE1EB8CD54F8A68EEB
- SPKI SHA-256: 5F80062F076A48B70BFFFAD8356585B5F4F50A70ADF7837B8D21C1E9C69B1415
- Validity: 2024-05-15 to 2034-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDVTLSRSACA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1c:9e:6b:41:2d:eb:0a:85:46:1d:e0:3d:be:30:98:4d:05:73:88:8b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: May 15 06:19:15 2024 GMT
            Not After : May 15 06:19:14 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                61:75:05:4E:1A:F5:0F:C1:60:20:20:C2:28:D9:8B:B3:E2:C1:7D:B4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5EB0217B928C2DE1170FCE110CACC3C89A42492E4F97F5AE1EB8CD54F8A68EEB
    SPKI SHA256: 5F80062F076A48B70BFFFAD8356585B5F4F50A70ADF7837B8D21C1E9C69B1415
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia DV TLS RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia DV TLS RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 031546F8D514B084FCBF53C66E0906CCD312A018
- SHA-256: E0DD6743D6D08E2AB18884ED1E7E46B3D9726FFFA9B1866642AEBF266FDA2654
- SPKI SHA-256: 4F6D6A5008DEE84F5F97DD20F3059B89A9479E5545AAAB45EA23B263CAA36A62
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaDVTLSRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:15:46:f8:d5:14:b0:84:fc:bf:53:c6:6e:09:06:cc:d3:12:a0:18
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia DV TLS RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                FF:D3:8B:E6:29:C8:A6:99:4D:E5:19:6B:F8:FF:AF:39:41:9D:7E:D6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E0DD6743D6D08E2AB18884ED1E7E46B3D9726FFFA9B1866642AEBF266FDA2654
    SPKI SHA256: 4F6D6A5008DEE84F5F97DD20F3059B89A9479E5545AAAB45EA23B263CAA36A62
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV Code Signing ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV Code Signing ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 393D6D7CD9AEEC1218693A45193E50252D1C63D4
- SHA-256: 6A423235B3B26C7DED5359BF0BAD4EE301729DAF8287244FC9995B0605268EDB
- SPKI SHA-256: 506A49CB4FB2A80AF8D6647E1C615D5F05073FC3F3E2B1DEB75AD9F48920EFE8
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVCodeSigningECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:3d:6d:7c:d9:ae:ec:12:18:69:3a:45:19:3e:50:25:2d:1c:63:d4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV Code Signing ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.3
                Policy: 1.3.6.1.4.1.44494.2.2.2
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                C7:22:B5:F7:C3:4A:DC:9B:2C:19:58:5B:C1:66:72:26:63:6C:F4:E3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6A423235B3B26C7DED5359BF0BAD4EE301729DAF8287244FC9995B0605268EDB
    SPKI SHA256: 506A49CB4FB2A80AF8D6647E1C615D5F05073FC3F3E2B1DEB75AD9F48920EFE8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV Code Signing RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV Code Signing RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 34274E253D4C5FEA6D68E26734394E14556E153D
- SHA-256: 982222E6B2485A0A80C17209630EA9749B8785E6C75D6475B3E4AA578D901DF5
- SPKI SHA-256: AC4E3548FD0BDDD61EA3A8D191A80983D9B2765AA7FBE6A30D961988842E6B0B
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVCodeSigningRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:27:4e:25:3d:4c:5f:ea:6d:68:e2:67:34:39:4e:14:55:6e:15:3d
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV Code Signing RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.3
                Policy: 1.3.6.1.4.1.44494.2.2.2
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                4B:25:72:DF:66:4C:BD:56:C3:F9:FB:ED:36:BC:28:7E:29:AE:03:26
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 982222E6B2485A0A80C17209630EA9749B8785E6C75D6475B3E4AA578D901DF5
    SPKI SHA256: AC4E3548FD0BDDD61EA3A8D191A80983D9B2765AA7FBE6A30D961988842E6B0B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV Code Signing RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV Code Signing RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 18688B266D6B4E5C42C3E776EC18C998508711BD
- SHA-256: DD169948C56F90D640E392F7A69452EC4B394E6AD179FF54F7E7DBB6AACFBDBA
- SPKI SHA-256: 2D3A52BC5A9D59E901F749E24CAD92932787764B45404F3F3C3326A462DD3A6C
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVCodeSigningRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            18:68:8b:26:6d:6b:4e:5c:42:c3:e7:76:ec:18:c9:98:50:87:11:bd
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV Code Signing RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.3
                Policy: 1.3.6.1.4.1.44494.2.2.2
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                21:7C:9E:5F:58:1A:C0:37:C9:EE:AC:CA:DA:99:DB:86:13:93:B1:C3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DD169948C56F90D640E392F7A69452EC4B394E6AD179FF54F7E7DBB6AACFBDBA
    SPKI SHA256: 2D3A52BC5A9D59E901F749E24CAD92932787764B45404F3F3C3326A462DD3A6C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.23.140.1.3, 1.3.6.1.4.1.44494.2.2.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS ECC CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G2
- Serial: 1F3861F8C926B5E0ED19FCA159CB6ABA0F4F0C13
- SHA-256: 2126C130F1D576FB70CF3B8E8C0EA2FEE8CFE98D721304EAAA6D898E721029CE
- SPKI SHA-256: 29EF858998A26FD883224DF428A3C99AED7FB87D272DB7B46D7AF2EBCDCE14EF
- Validity: 2020-08-27 to 2040-08-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVTLSECCCA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1f:38:61:f8:c9:26:b5:e0:ed:19:fc:a1:59:cb:6a:ba:0f:4f:0c:13
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G2
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS ECC CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                4F:EB:29:96:F4:F1:42:DE:5A:A2:07:56:B2:FF:59:C2:85:3E:C3:98
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
            X509v3 Subject Key Identifier:
                1C:72:95:34:89:D7:56:FE:3D:84:BD:AD:33:B5:1C:1D:D9:47:25:36
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2126C130F1D576FB70CF3B8E8C0EA2FEE8CFE98D721304EAAA6D898E721029CE
    SPKI SHA256: 29EF858998A26FD883224DF428A3C99AED7FB87D272DB7B46D7AF2EBCDCE14EF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS ECC CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 06CFBA43CEEE00E9DF6FC9DB920BC6ECFBD0AB70
- SHA-256: B00AE50AE1AC39990E1E189E052F37F3D80BDFA6E4DEA8FE990C07B60E64ED94
- SPKI SHA-256: 5743C5FCD3926E28AAED504C6890CF2D0DE19BD138FF39A37754EBFB0BB64C63
- Validity: 2024-05-15 to 2034-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:cf:ba:43:ce:ee:00:e9:df:6f:c9:db:92:0b:c6:ec:fb:d0:ab:70
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: May 15 06:18:46 2024 GMT
            Not After : May 15 06:18:45 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                CF:46:4E:83:11:46:D7:95:86:6B:6A:5F:BC:FE:AA:3D:BD:13:11:B4
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B00AE50AE1AC39990E1E189E052F37F3D80BDFA6E4DEA8FE990C07B60E64ED94
    SPKI SHA256: 5743C5FCD3926E28AAED504C6890CF2D0DE19BD138FF39A37754EBFB0BB64C63
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS ECC CA 2024 V2

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA 2024 V2
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 3EE29E0361631977DFA38107621BD572FFA78B48
- SHA-256: D19E1FCD8E12747D75B74A28318EEFDD700F616E2B215701BBE804C3CDDA027B
- SPKI SHA-256: ED4EB5799E31306DF1EAA1E97D661598A2564DD89A6152142C8C7433F446DDAE
- Validity: 2024-07-18 to 2034-07-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVTLSECCCA2024V2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3e:e2:9e:03:61:63:19:77:df:a3:81:07:62:1b:d5:72:ff:a7:8b:48
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Jul 18 02:14:54 2024 GMT
            Not After : Jul 18 02:14:53 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS ECC CA 2024 V2
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.44494.2.1.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                8E:8E:CB:35:F1:81:58:AA:20:2D:CE:C3:36:16:8A:10:11:38:59:C7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D19E1FCD8E12747D75B74A28318EEFDD700F616E2B215701BBE804C3CDDA027B
    SPKI SHA256: ED4EB5799E31306DF1EAA1E97D661598A2564DD89A6152142C8C7433F446DDAE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 034348D5F195805510494776E2042F02256E2A9E
- SHA-256: C261EE3D4BBDC456FFB67868363FED80CB5C9AD7AF3F5A5DACBE32BECDDD88A7
- SPKI SHA-256: F32138FB539EB08D6FF095F3A52A78ED72C5C2B261D9F121567B2CB6611FDCA8
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVTLSECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:43:48:d5:f1:95:80:55:10:49:47:76:e2:04:2f:02:25:6e:2a:9e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                EF:46:43:9C:E9:F4:12:1D:F1:1A:18:19:68:57:1D:84:BA:AF:7D:19
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C261EE3D4BBDC456FFB67868363FED80CB5C9AD7AF3F5A5DACBE32BECDDD88A7
    SPKI SHA256: F32138FB539EB08D6FF095F3A52A78ED72C5C2B261D9F121567B2CB6611FDCA8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 0DA3512250DC98070AA6B1999F0A98B980958669
- SHA-256: 853B06C42E26160305CC3DD5B1F7F7DC6BAC5602C0F444F08D45A7DEE1F47CF8
- SPKI SHA-256: 071408F259C9D2FCC02E200C4D62D713D8E7362CFC83B888C91E9B86065548DE
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVTLSRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:a3:51:22:50:dc:98:07:0a:a6:b1:99:9f:0a:98:b9:80:95:86:69
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                9C:95:68:3D:D4:3A:C0:3D:D2:BA:2B:AC:31:5C:4C:AD:53:BC:90:CD
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 853B06C42E26160305CC3DD5B1F7F7DC6BAC5602C0F444F08D45A7DEE1F47CF8
    SPKI SHA256: 071408F259C9D2FCC02E200C4D62D713D8E7362CFC83B888C91E9B86065548DE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS RSA CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 0D10E9F89400260FD7B5152EB88FE101FC4AC149
- SHA-256: 7584878B5216BA52A36978FE728356525BD7E07F3D39B50C49C394C02542C58C
- SPKI SHA-256: 33344DE1C40FD22F76B9A2DA4E59B60C6DE6CD7414FBA4BD198AAE17C1877F62
- Validity: 2024-05-15 to 2034-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: -
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:10:e9:f8:94:00:26:0f:d7:b5:15:2e:b8:8f:e1:01:fc:4a:c1:49
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: May 15 06:18:56 2024 GMT
            Not After : May 15 06:18:55 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                F7:4D:CA:2F:46:AA:3C:DD:4E:3D:75:79:3A:5C:A2:6E:B3:38:81:DB
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 7584878B5216BA52A36978FE728356525BD7E07F3D39B50C49C394C02542C58C
    SPKI SHA256: 33344DE1C40FD22F76B9A2DA4E59B60C6DE6CD7414FBA4BD198AAE17C1877F62
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS RSA CA 2024 V2

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA 2024 V2
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 05549DB6577B1EE7E31DAEE8B8E5B273A864EC51
- SHA-256: D886C235FAFADD2E4734924CF58B4D8F0CB7065F0F5451B3E1C308F92EF7B2EB
- SPKI SHA-256: 4DCC2C26100AC1620254DE90FFEEEADF2EDE46BADFCB78F3A5E429990409D712
- Validity: 2024-07-18 to 2034-07-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVTLSRSACA2024V2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:54:9d:b6:57:7b:1e:e7:e3:1d:ae:e8:b8:e5:b2:73:a8:64:ec:51
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Jul 18 02:14:55 2024 GMT
            Not After : Jul 18 02:14:54 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS RSA CA 2024 V2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.44494.2.1.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                5B:1A:31:46:30:DC:33:25:DD:98:25:8E:EF:84:D1:89:CA:4B:B8:26
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D886C235FAFADD2E4734924CF58B4D8F0CB7065F0F5451B3E1C308F92EF7B2EB
    SPKI SHA256: 4DCC2C26100AC1620254DE90FFEEEADF2EDE46BADFCB78F3A5E429990409D712
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia EV TLS RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia EV TLS RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 380AEBFFA601065E382FBB981FA8F02815F66E9B
- SHA-256: 15DDF98C57E0F46E5C5EE00283BC4AF8FE0E8D2C42151630DEFFFA285EA62D09
- SPKI SHA-256: 5B5F676C6BE5ECE8D64743839E9AD8B529618EAFD09C375DB05BFA0F62062A60
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaEVTLSRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:0a:eb:ff:a6:01:06:5e:38:2f:bb:98:1f:a8:f0:28:15:f6:6e:9b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia EV TLS RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                22:C2:92:A6:31:63:AC:13:C7:17:6A:4F:31:3B:25:72:73:7C:D2:6A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 15DDF98C57E0F46E5C5EE00283BC4AF8FE0E8D2C42151630DEFFFA285EA62D09
    SPKI SHA256: 5B5F676C6BE5ECE8D64743839E9AD8B529618EAFD09C375DB05BFA0F62062A60
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS ECC CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G2
- Serial: 413E9C17BA2D87E4E59FA3CD8FE248C56869E40C
- SHA-256: 5655EAAF7133936558CADDE8F3447615F759C9C63BEE949D4DC3CD7FB71FCBED
- SPKI SHA-256: CA4068FB55CEE7962C5486AA0DA1318E6CC036E4C8E69879052654235C3312D9
- Validity: 2020-08-27 to 2040-08-26
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaOVTLSECCCA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:3e:9c:17:ba:2d:87:e4:e5:9f:a3:cd:8f:e2:48:c5:68:69:e4:0c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G2
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS ECC CA
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                4F:EB:29:96:F4:F1:42:DE:5A:A2:07:56:B2:FF:59:C2:85:3E:C3:98
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
            X509v3 Subject Key Identifier:
                F3:11:8C:08:80:3C:E2:E7:D6:93:01:9F:7D:42:2B:AC:7B:4D:E3:9F
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5655EAAF7133936558CADDE8F3447615F759C9C63BEE949D4DC3CD7FB71FCBED
    SPKI SHA256: CA4068FB55CEE7962C5486AA0DA1318E6CC036E4C8E69879052654235C3312D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG2
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS ECC CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 22059CEF8152E9CA7C36870B512B2F1622B76330
- SHA-256: 0E975E62A83030EAE3F441BAFFBFD7574FB7235EECB50F1F747DF8F0506D245E
- SPKI SHA-256: 6917D32AB6980B145C80AF3708DB970C43E03A34FCF8D6FA6F2D83AE276A9C24
- Validity: 2024-05-15 to 2034-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaOVTLSECCCA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            22:05:9c:ef:81:52:e9:ca:7c:36:87:0b:51:2b:2f:16:22:b7:63:30
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: May 15 06:19:00 2024 GMT
            Not After : May 15 06:18:59 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                A4:53:4B:A5:25:BA:AA:84:8E:0B:87:9D:C9:4E:AA:3A:DD:0E:BA:C6
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0E975E62A83030EAE3F441BAFFBFD7574FB7235EECB50F1F747DF8F0506D245E
    SPKI SHA256: 6917D32AB6980B145C80AF3708DB970C43E03A34FCF8D6FA6F2D83AE276A9C24
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: Only DigitalSignature and KeyAgreement key usages are allowed for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 13193F2D799AEC4914D80D48DD874958D25FDFA0
- SHA-256: EEE6BAF50B14BCA04202B496737E676F713E7431FFD4FCA1309F661481EC520F
- SPKI SHA-256: 1FD0B721D5585D96DEA937F4D31ED959D38B4C54B841024697B58E3931037F12
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaOVTLSECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:19:3f:2d:79:9a:ec:49:14:d8:0d:48:dd:87:49:58:d2:5f:df:a0
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                76:53:32:21:F3:6F:76:9D:58:53:29:33:BE:F5:48:B9:E2:28:4F:EF
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: EEE6BAF50B14BCA04202B496737E676F713E7431FFD4FCA1309F661481EC520F
    SPKI SHA256: 1FD0B721D5585D96DEA937F4D31ED959D38B4C54B841024697B58E3931037F12
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 633A7242558112E6F5D54B2E4BDC8EC32FD7CC0A
- SHA-256: 624FD02328D23289573EBA7D1845258D70E15BC281E7DA38DCE06A5712B254A1
- SPKI SHA-256: AE88587D2B6A6E715A4EBBE69F9ADAE9825787B7773F60501F0B88E06909F2E5
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaOVTLSRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:3a:72:42:55:81:12:e6:f5:d5:4b:2e:4b:dc:8e:c3:2f:d7:cc:0a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                EF:D7:A5:E0:37:5A:8E:6A:5D:60:CF:BB:DD:FE:80:F2:38:39:85:EA
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 624FD02328D23289573EBA7D1845258D70E15BC281E7DA38DCE06A5712B254A1
    SPKI SHA256: AE88587D2B6A6E715A4EBBE69F9ADAE9825787B7773F60501F0B88E06909F2E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS RSA CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 3693BA35D7DB22AB5A259B8C9DF650F378AF5C74
- SHA-256: D0B626C8AD93962296B3920106ED7FB3818FCB98E0B73E799141B42521335B0F
- SPKI SHA-256: 56D83A162F39E0A683C74F31F205EF9B3F260A7D077F81F383D771AC30EA772E
- Validity: 2024-05-15 to 2034-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaOVTLSRSACA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            36:93:ba:35:d7:db:22:ab:5a:25:9b:8c:9d:f6:50:f3:78:af:5c:74
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: May 15 06:19:06 2024 GMT
            Not After : May 15 06:19:05 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                96:7C:13:42:72:4B:3A:93:6C:50:1A:ED:EE:18:11:3A:9F:9C:25:0D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D0B626C8AD93962296B3920106ED7FB3818FCB98E0B73E799141B42521335B0F
    SPKI SHA256: 56D83A162F39E0A683C74F31F205EF9B3F260A7D077F81F383D771AC30EA772E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia OV TLS RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia OV TLS RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 4E0185FA47D3BA387C9A38A7D106EDB69CFAE5B4
- SHA-256: 573F5F797482F567EDC7901879457BC46C9DF0ACFD8CE7B1A8FB7E2218FA477B
- SPKI SHA-256: DFEF3980166A0AA32DAD1D56F39791AB7FD4E65BCBDA9501CFB5F4494438D582
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaOVTLSRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:01:85:fa:47:d3:ba:38:7c:9a:38:a7:d1:06:ed:b6:9c:fa:e5:b4
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia OV TLS RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                22:AA:DB:B4:2F:7F:3C:18:3F:71:7E:CD:61:FD:4E:CE:46:56:EF:54
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 573F5F797482F567EDC7901879457BC46C9DF0ACFD8CE7B1A8FB7E2218FA477B
    SPKI SHA256: DFEF3980166A0AA32DAD1D56F39791AB7FD4E65BCBDA9501CFB5F4494438D582
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Secure Email ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Secure Email ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 78CF88D3B1EEA037626C283191613498E5B1E9B6
- SHA-256: 70342F6C5E0FD9F9ABE3C1448D033E1A0CAB4CC560409E1C03B626E48B8B16DD
- SPKI SHA-256: 6FD92957E7F96B27D201C43DBF7E0EE79CF400A6BD2AF2BEE545EBAA5144E43E
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSecureEmailECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:cf:88:d3:b1:ee:a0:37:62:6c:28:31:91:61:34:98:e5:b1:e9:b6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Secure Email ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                61:32:50:57:4B:F3:26:6A:E9:C8:D7:C6:13:37:F1:7E:15:53:B3:AC
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 70342F6C5E0FD9F9ABE3C1448D033E1A0CAB4CC560409E1C03B626E48B8B16DD
    SPKI SHA256: 6FD92957E7F96B27D201C43DBF7E0EE79CF400A6BD2AF2BEE545EBAA5144E43E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Secure Email RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Secure Email RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 2D54E342F8F672FE37E240560554B568D031E88C
- SHA-256: E67767E9C72E0691497F66616590D99AFDC60974FE6F1F4F1BFD71B2A13E2C03
- SPKI SHA-256: 8B5FC080B9EC9B1E42796C547D6B67A07B62BA223B6848993B8DE9E548B6CD5B
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSecureEmailRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2d:54:e3:42:f8:f6:72:fe:37:e2:40:56:05:54:b5:68:d0:31:e8:8c
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Secure Email RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                FC:B3:E3:3D:44:84:55:D2:FF:17:2D:1C:4D:F9:61:09:03:C6:D9:4A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: E67767E9C72E0691497F66616590D99AFDC60974FE6F1F4F1BFD71B2A13E2C03
    SPKI SHA256: 8B5FC080B9EC9B1E42796C547D6B67A07B62BA223B6848993B8DE9E548B6CD5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia Secure Email RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Secure Email RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 130FCA6FD7E9C6516C85F1AAEEF0BB4225C014F5
- SHA-256: C84E9EE5225DF7B674A57343C6D48921907E9764010042E40B2C00F944639CA4
- SPKI SHA-256: 7FD6061096329FE7331094793FACDAE8CE58024E84EDE58FDA85AAA2BA8911CF
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSecureEmailRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:0f:ca:6f:d7:e9:c6:51:6c:85:f1:aa:ee:f0:bb:42:25:c0:14:f5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Secure Email RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                EB:16:4C:7D:74:8A:09:1C:57:87:C3:5B:9B:98:FF:21:36:C3:B2:0A
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C84E9EE5225DF7B674A57343C6D48921907E9764010042E40B2C00F944639CA4
    SPKI SHA256: 7FD6061096329FE7331094793FACDAE8CE58024E84EDE58FDA85AAA2BA8911CF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia SMIME ECC CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME ECC CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME ECC Root CA
- Serial: 1187CB9FA2256B16699E547FBDB2459A24761965
- SHA-256: E21C0762F0B1777AB2B06E9F9273BE251AB9FBB3D5DD901F60750EF9B53B8488
- SPKI SHA-256: 4B3A1E5AEFF5C127A6B28BAE3F36A99E5B6E9147D7A1D84B8E1261C233440FB7
- Validity: 2024-05-15 to 2034-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSMIMEECCCA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaSMIMEECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaSMIMEECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            11:87:cb:9f:a2:25:6b:16:69:9e:54:7f:bd:b2:45:9a:24:76:19:65
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME ECC Root CA
        Validity
            Not Before: May 15 06:19:19 2024 GMT
            Not After : May 15 06:19:18 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                31:67:E6:72:B2:0D:E6:22:A0:AC:CF:7E:22:A7:59:32:E3:66:23:A5
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaSMIMEECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaSMIMEECCRootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaSMIMEECCRootCA.crl
            X509v3 Subject Key Identifier:
                E1:B0:57:35:7F:7E:7E:7F:C8:B1:08:D3:9A:A6:D1:F9:51:EB:9A:A3
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E21C0762F0B1777AB2B06E9F9273BE251AB9FBB3D5DD901F60750EF9B53B8488
    SPKI SHA256: 4B3A1E5AEFF5C127A6B28BAE3F36A99E5B6E9147D7A1D84B8E1261C233440FB7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaSMIMEECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaSMIMEECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaSMIMEECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia SMIME RSA CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME RSA CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia SMIME RSA Root CA
- Serial: 061CF8CF378D9732F91EDAA2F135B33E9923C9A1
- SHA-256: BC2197C0C1FF17C553370BF9955B9B50C8C9D27A0C28F78704E00C881F1458AA
- SPKI SHA-256: 477DF46C6DEE715EF037BEA61DE1AB43828D395E811FDD83EEAA3809CEE82279
- Validity: 2024-05-15 to 2034-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaSMIMERSACA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaSMIMERSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaSMIMERSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:1c:f8:cf:37:8d:97:32:f9:1e:da:a2:f1:35:b3:3e:99:23:c9:a1
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME RSA Root CA
        Validity
            Not Before: May 15 06:19:23 2024 GMT
            Not After : May 15 06:19:22 2034 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia SMIME RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                80:1A:AA:43:C1:C9:7F:8B:1A:96:45:BC:3D:BB:6B:48:52:6C:5B:AB
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaSMIMERSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaSMIMERSARootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaSMIMERSARootCA.crl
            X509v3 Subject Key Identifier:
                20:74:1B:3D:53:25:D2:96:8E:28:46:81:67:E4:3D:B5:05:50:78:4B
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BC2197C0C1FF17C553370BF9955B9B50C8C9D27A0C28F78704E00C881F1458AA
    SPKI SHA256: 477DF46C6DEE715EF037BEA61DE1AB43828D395E811FDD83EEAA3809CEE82279
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaSMIMERSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaSMIMERSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaSMIMERSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TimeStamping ECC CA G4

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TimeStamping ECC CA G4
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G4
- Serial: 0C6E5416FA87AF859959A8F5019F6C1AACA0AE64
- SHA-256: B917AB79332B73B938655289C287F183E55B1BC60873845ABA119DB93D2E3C08
- SPKI SHA-256: D7944B71FF9EB15540BF8E4799AB966802CF278A646E599577303AFF10A4199A
- Validity: 2021-05-20 to 2041-05-19
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTimeStampingECCCAG4.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:6e:54:16:fa:87:af:85:99:59:a8:f5:01:9f:6c:1a:ac:a0:ae:64
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G4
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TimeStamping ECC CA G4
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                A5:BB:4A:97:CE:B3:2B:7F:A4:31:DE:97:83:59:83:A6:6F:71:CB:DE
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
            X509v3 Subject Key Identifier:
                6C:DF:8F:26:7C:E8:20:FE:62:9B:3F:A8:1F:15:EE:EA:7C:F5:4C:46
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B917AB79332B73B938655289C287F183E55B1BC60873845ABA119DB93D2E3C08
    SPKI SHA256: D7944B71FF9EB15540BF8E4799AB966802CF278A646E599577303AFF10A4199A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG4
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG4.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TimeStamping RSA CA

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TimeStamping RSA CA
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G1
- Serial: 0E32D84739599F2385B3A4BA570B99D272D7DA38
- SHA-256: 748F6BD8667C2158C3E38427D9039BE0BC4C016EF0BEEB73B8BDFF042B343974
- SPKI SHA-256: 8F9254F7E55ABC4F260992EF20154ACA0125DFEF6A31778AB09244768FEAD3BB
- Validity: 2020-08-27 to 2040-08-26
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTimeStampingRSACA.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:32:d8:47:39:59:9f:23:85:b3:a4:ba:57:0b:99:d2:72:d7:da:38
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G1
        Validity
            Not Before: Aug 27 07:00:00 2020 GMT
            Not After : Aug 26 12:00:00 2040 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TimeStamping RSA CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                24:C2:0F:2C:CD:C0:B5:15:4F:6B:6D:D4:F2:F0:58:FE:14:43:DF:F4
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
            X509v3 Subject Key Identifier:
                7F:0B:BE:8B:B4:23:29:F2:81:1B:0A:53:84:15:AB:CE:62:7E:5B:D8
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 748F6BD8667C2158C3E38427D9039BE0BC4C016EF0BEEB73B8BDFF042B343974
    SPKI SHA256: 8F9254F7E55ABC4F260992EF20154ACA0125DFEF6A31778AB09244768FEAD3BB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG1
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TimeStamping RSA CA G3

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TimeStamping RSA CA G3
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia Global Root CA G3
- Serial: 41650D95FBE9E9415F72F93920638E5CF3BE1281
- SHA-256: 904A794C7512049947594746743265348A339A7573E2323B9D4BE89BBAFA5D52
- SPKI SHA-256: BD8FACE80F6D946094D71EFCC28F6445F001FD39CB063CBA580363E5A60AE8DF
- Validity: 2021-05-20 to 2041-05-19
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: TrustAsia Technologies, Inc.
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTimeStampingRSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            41:65:0d:95:fb:e9:e9:41:5f:72:f9:39:20:63:8e:5c:f3:be:12:81
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia Global Root CA G3
        Validity
            Not Before: May 20 05:00:00 2021 GMT
            Not After : May 19 12:00:00 2041 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TimeStamping RSA CA G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                40:E4:E4:F2:23:EF:38:CA:B0:AE:57:7F:F2:21:30:16:34:DB:BC:92
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: https://www.trustasia.com/CPS
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
            X509v3 Subject Key Identifier:
                8B:EE:09:E6:49:C6:38:F4:A4:51:76:DB:AE:1B:10:13:AF:23:17:75
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 904A794C7512049947594746743265348A339A7573E2323B9D4BE89BBAFA5D52
    SPKI SHA256: BD8FACE80F6D946094D71EFCC28F6445F001FD39CB063CBA580363E5A60AE8DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaGlobalRootCAG3
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaGlobalRootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TSA ECC CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA ECC CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA ECC Root CA
- Serial: 582E876567FBE19C8F1B7CB9A55FCC8F34FB6016
- SHA-256: 03053C0713B9543C40B2331FF5B571270DF729B41087DF450BCE44F455AB8158
- SPKI SHA-256: 0F7AB0F1F46D0083896655715D6398015E6EC8C68F57DE303E773D7BE0379CB4
- Validity: 2024-05-15 to 2044-05-15
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTSAECCCA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTSAECCRootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTSAECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:2e:87:65:67:fb:e1:9c:8f:1b:7c:b9:a5:5f:cc:8f:34:fb:60:16
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA ECC Root CA
        Validity
            Not Before: May 15 06:19:35 2024 GMT
            Not After : May 15 06:19:34 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA ECC CA 2024
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                25:A6:6C:22:F3:80:04:26:63:33:6C:FD:25:A4:1E:47:34:FD:FB:6E
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTSAECCRootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTSAECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.2
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTSAECCRootCA.crl
            X509v3 Subject Key Identifier:
                D0:80:C7:1A:27:16:F0:7A:FC:00:D4:50:A1:AA:C5:F2:2F:B3:17:9D
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 03053C0713B9543C40B2331FF5B571270DF729B41087DF450BCE44F455AB8158
    SPKI SHA256: 0F7AB0F1F46D0083896655715D6398015E6EC8C68F57DE303E773D7BE0379CB4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTSAECCRootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTSAECCRootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTSAECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### TrustAsia TSA RSA CA 2024

- Subject: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA RSA CA 2024
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TSA RSA Root CA
- Serial: 1930CD6C674A90F5A228C01E3729B4F04FC3BB53
- SHA-256: 6AC8AF44575A99945D01DD0BD675277242D7DD1A515A84D68E530EC5000363C6
- SPKI SHA-256: 154CB0A6AB3AA7B8DF2886E324929C41A1EDB7B5B41C69E92B28366EF69FA8E3
- Validity: 2024-05-15 to 2044-05-15
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.wt.trustasia.com/TrustAsiaTSARSACA2024.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTSARSARootCA
- CRL DP: http://crl.wt.trustasia.com/TrustAsiaTSARSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            19:30:cd:6c:67:4a:90:f5:a2:28:c0:1e:37:29:b4:f0:4f:c3:bb:53
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA RSA Root CA
        Validity
            Not Before: May 15 06:19:40 2024 GMT
            Not After : May 15 06:19:39 2044 GMT
        Subject: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TSA RSA CA 2024
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                38:DC:70:12:94:44:CD:6C:20:5E:3F:D2:6A:E5:A4:B3:F9:EF:AF:A0
            Authority Information Access:
                CA Issuers - URI:http://ica.wt.trustasia.com/TrustAsiaTSARSARootCA.crt
                OCSP - URI:http://ocsp.wt.trustasia.com/TrustAsiaTSARSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.4.2
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.wt.trustasia.com/TrustAsiaTSARSARootCA.crl
            X509v3 Subject Key Identifier:
                81:F6:37:77:03:4F:1E:B4:69:41:6D:FF:A4:BB:36:3A:EE:24:E1:31
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6AC8AF44575A99945D01DD0BD675277242D7DD1A515A84D68E530EC5000363C6
    SPKI SHA256: 154CB0A6AB3AA7B8DF2886E324929C41A1EDB7B5B41C69E92B28366EF69FA8E3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: digitalSignature, keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.23.140.1.4.2
- AIA OCSP: http://ocsp.wt.trustasia.com/TrustAsiaTSARSARootCA
- AIA CA Issuers: http://ica.wt.trustasia.com/TrustAsiaTSARSARootCA.crt
- CRL Distribution Points: http://crl.wt.trustasia.com/TrustAsiaTSARSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Unicom DV TLS ECC CA 2026

- Subject: countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom DV TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 626AEE8BBCBFDD67B564E96ECA2C27CADA316A53
- SHA-256: 22308985643AAA31DEFD3B66AC3196E8F85141520D749C56BCA5357F36ECC166
- SPKI SHA-256: D7091C6BF867FD5C7AA5169DC49B8796473DCB38042CF690BF1C9C0254F0F3A9
- Validity: 2026-04-28 to 2029-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/UnicomDVTLSECCCA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:6a:ee:8b:bc:bf:dd:67:b5:64:e9:6e:ca:2c:27:ca:da:31:6a:53
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Apr 28 05:32:03 2026 GMT
            Not After : Apr 28 05:32:02 2029 GMT
        Subject: C = CN, O = "China Unicom Intelligent Security Technology Co., Ltd", CN = Unicom DV TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                69:45:7C:57:AA:7D:85:2E:ED:9A:0F:8A:81:91:4F:CD:A3:45:91:56
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 22308985643AAA31DEFD3B66AC3196E8F85141520D749C56BCA5357F36ECC166
    SPKI SHA256: D7091C6BF867FD5C7AA5169DC49B8796473DCB38042CF690BF1C9C0254F0F3A9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Unicom DV TLS RSA CA 2026

- Subject: countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom DV TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 21FB9F4D6CE2EE857E9D79B6CF4145793CA60966
- SHA-256: 6DFF56CFA823978CB9AFF815C3C6986DFB360C63B324A2CB48F5B36335F6F344
- SPKI SHA-256: 5930958DFB032BAD59D3B9E4590FBFC39B0DE16F2C7D5D9CCBC19C72712528BF
- Validity: 2026-04-28 to 2029-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/UnicomDVTLSRSACA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:fb:9f:4d:6c:e2:ee:85:7e:9d:79:b6:cf:41:45:79:3c:a6:09:66
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Apr 28 05:32:00 2026 GMT
            Not After : Apr 28 05:31:59 2029 GMT
        Subject: C = CN, O = "China Unicom Intelligent Security Technology Co., Ltd", CN = Unicom DV TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                7C:7E:43:E1:25:91:E3:42:F6:79:F0:21:76:E8:75:D2:4D:D2:8F:88
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6DFF56CFA823978CB9AFF815C3C6986DFB360C63B324A2CB48F5B36335F6F344
    SPKI SHA256: 5930958DFB032BAD59D3B9E4590FBFC39B0DE16F2C7D5D9CCBC19C72712528BF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Unicom TLS ECC CA 2026

- Subject: countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom TLS ECC CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 51B455DD9E0E78EBD17751409806555606DC50D4
- SHA-256: D382F9ABD9494129B4F4E55C52A6DDEF195953CD2C871A01A53F3CBFCA57C4F2
- SPKI SHA-256: 37ECBF2E8652E75377C624F1A4835419C013ADE00EEF32A27746B13C18F0415D
- Validity: 2026-04-28 to 2029-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/UnicomTLSECCCA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            51:b4:55:dd:9e:0e:78:eb:d1:77:51:40:98:06:55:56:06:dc:50:d4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Apr 28 05:32:11 2026 GMT
            Not After : Apr 28 05:32:10 2029 GMT
        Subject: C = CN, O = "China Unicom Intelligent Security Technology Co., Ltd", CN = Unicom TLS ECC CA 2026
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                04:97:38:8E:C1:70:75:B7:7F:84:AC:79:68:90:09:73:72:07:49:1E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: D382F9ABD9494129B4F4E55C52A6DDEF195953CD2C871A01A53F3CBFCA57C4F2
    SPKI SHA256: 37ECBF2E8652E75377C624F1A4835419C013ADE00EEF32A27746B13C18F0415D
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Unicom TLS RSA CA 2026

- Subject: countryName=CN, organizationName=China Unicom Intelligent Security Technology Co., Ltd, commonName=Unicom TLS RSA CA 2026
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 0C10DF2B6E8FA5ACA9E0B234E19767856719BD55
- SHA-256: 6FF5FB96C87E5A384D61B25A5BDAE087F804DE20DDA876050CE10AC5018A5415
- SPKI SHA-256: 1C95AD3094A1FA71B57E711C6BA2B2D9638C86C3FDE89717525FB6A738235F85
- Validity: 2026-04-28 to 2029-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/UnicomTLSRSACA2026.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:10:df:2b:6e:8f:a5:ac:a9:e0:b2:34:e1:97:67:85:67:19:bd:55
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Apr 28 05:32:07 2026 GMT
            Not After : Apr 28 05:32:06 2029 GMT
        Subject: C = CN, O = "China Unicom Intelligent Security Technology Co., Ltd", CN = Unicom TLS RSA CA 2026
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                1F:8C:76:96:49:FD:C2:97:0C:E3:C9:FC:A8:FC:73:97:72:38:57:01
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6FF5FB96C87E5A384D61B25A5BDAE087F804DE20DDA876050CE10AC5018A5415
    SPKI SHA256: 1C95AD3094A1FA71B57E711C6BA2B2D9638C86C3FDE89717525FB6A738235F85
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet DV TLS ECC CA 2025

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet DV TLS ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 7865B114AB61C27244CA80ACA10DB7FFC20EA994
- SHA-256: 444B2CBD5E5C0FB1910525B5C99363B03B6496EA4A0ACD03A081DA9821FDFCB7
- SPKI SHA-256: 20BBF1F408B55DA8B6EEFBBBEED0C32FEBB195CCC0E3EFF976648868C2849AC4
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/XinNetDVTLSECCCA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:65:b1:14:ab:61:c2:72:44:ca:80:ac:a1:0d:b7:ff:c2:0e:a9:94
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:08:41 2025 GMT
            Not After : Oct 21 06:08:40 2030 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet DV TLS ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                B3:6E:0C:6A:4E:62:8D:A7:5A:36:FD:6B:EA:3F:9B:CF:71:0B:73:72
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 444B2CBD5E5C0FB1910525B5C99363B03B6496EA4A0ACD03A081DA9821FDFCB7
    SPKI SHA256: 20BBF1F408B55DA8B6EEFBBBEED0C32FEBB195CCC0E3EFF976648868C2849AC4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet DV TLS RSA CA 2025

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet DV TLS RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 0D75788625BCAACA71EA2E6EDBEAE8EF72BC2A25
- SHA-256: 6B44BD0934E37E144307D5DE3591344C81482DCA70D7D8D6ECB4F59802FC0F85
- SPKI SHA-256: 120B0976AAC4B1E461EB35EF00A5E7A9005D939773DEF1BF34BA20D1A8F1AF7B
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/XinNetDVTLSRSACA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:75:78:86:25:bc:aa:ca:71:ea:2e:6e:db:ea:e8:ef:72:bc:2a:25
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:08:45 2025 GMT
            Not After : Oct 21 06:08:44 2030 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet DV TLS RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                90:ED:7A:2D:6F:24:E4:DD:19:F1:8E:AF:E1:23:5F:B5:A5:24:E9:F9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6B44BD0934E37E144307D5DE3591344C81482DCA70D7D8D6ECB4F59802FC0F85
    SPKI SHA256: 120B0976AAC4B1E461EB35EF00A5E7A9005D939773DEF1BF34BA20D1A8F1AF7B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet EV TLS ECC CA 2025

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet EV TLS ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 48FC7548CC1C293805D298FE2E3A3649AF6B2274
- SHA-256: CA87FC9758893E2F608966DE66EA5E6E8547046071A491807484E3BD0D9B8FD4
- SPKI SHA-256: 48E2B2165A82C5219B7BC5271B46FD649F27C2F7518D942B49C96015A2CB4657
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/XinNetEVTLSECCCA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            48:fc:75:48:cc:1c:29:38:05:d2:98:fe:2e:3a:36:49:af:6b:22:74
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:08:48 2025 GMT
            Not After : Oct 21 06:08:47 2030 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet EV TLS ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.44494.2.1.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                3A:EE:CD:B8:E3:BE:C6:41:B9:10:8B:CF:D4:FB:26:3C:D2:A4:BB:3A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CA87FC9758893E2F608966DE66EA5E6E8547046071A491807484E3BD0D9B8FD4
    SPKI SHA256: 48E2B2165A82C5219B7BC5271B46FD649F27C2F7518D942B49C96015A2CB4657
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet EV TLS RSA CA 2025

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet EV TLS RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 16A95F0D860948CDF41DE70BB6E108440C1396E8
- SHA-256: 8F2EE5A96CCD83A2B7FA82582A52B49AEFB1164B928F5E39A041288A6103DFD4
- SPKI SHA-256: D581C9ADD712473FD2EB45414C0EA3B38FE47E31D81EEE99B6D450FCFFE1BB29
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/XinNetEVTLSRSACA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:a9:5f:0d:86:09:48:cd:f4:1d:e7:0b:b6:e1:08:44:0c:13:96:e8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:08:51 2025 GMT
            Not After : Oct 21 06:08:50 2030 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet EV TLS RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.1
                Policy: 1.3.6.1.4.1.44494.2.1.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                8A:C9:7B:7B:C6:82:52:4A:45:B7:2E:4B:A6:4A:C9:53:2D:E0:C9:C1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8F2EE5A96CCD83A2B7FA82582A52B49AEFB1164B928F5E39A041288A6103DFD4
    SPKI SHA256: D581C9ADD712473FD2EB45414C0EA3B38FE47E31D81EEE99B6D450FCFFE1BB29
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.1, 1.3.6.1.4.1.44494.2.1.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet OV TLS ECC CA 2025

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet OV TLS ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 7B232468C676C9E9C7C9365771F94D2C5E40033B
- SHA-256: 62B54213496E9101FFAFC8FAB3E68357F79A259F67F3D7860FA76754AF5BF0DB
- SPKI SHA-256: 51962DBD50C3CB838661F6A8017980DABED24265DA4BDEEDC566147EBD57D489
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/XinNetOVTLSECCCA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:23:24:68:c6:76:c9:e9:c7:c9:36:57:71:f9:4d:2c:5e:40:03:3b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:08:54 2025 GMT
            Not After : Oct 21 06:08:53 2030 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet OV TLS ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                6B:5C:C9:FF:B6:35:5C:08:84:80:35:3C:D4:FE:AF:16:B5:E9:93:BE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 62B54213496E9101FFAFC8FAB3E68357F79A259F67F3D7860FA76754AF5BF0DB
    SPKI SHA256: 51962DBD50C3CB838661F6A8017980DABED24265DA4BDEEDC566147EBD57D489
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### XinNet OV TLS RSA CA 2025

- Subject: countryName=CN, organizationName=Xin Net Technology Corp., commonName=XinNet OV TLS RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 792E2372F1E3EBB8E5017BC28532E0FFEA858722
- SHA-256: 5F8E084A637F101975F29272DC35EEB0AFDE0F857B519FB558319DE700CA5EC2
- SPKI SHA-256: 26E14C41E4BF6A963C1A27AEEB3F3E04B90A685413FB292362CF122028DB53C7
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/XinNetOVTLSRSACA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:2e:23:72:f1:e3:eb:b8:e5:01:7b:c2:85:32:e0:ff:ea:85:87:22
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:08:57 2025 GMT
            Not After : Oct 21 06:08:56 2030 GMT
        Subject: C = CN, O = Xin Net Technology Corp., CN = XinNet OV TLS RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.2
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                4C:B3:D1:8A:FF:C1:C3:EC:95:FD:AC:33:C7:A4:7D:46:24:3A:12:D5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 5F8E084A637F101975F29272DC35EEB0AFDE0F857B519FB558319DE700CA5EC2
    SPKI SHA256: 26E14C41E4BF6A963C1A27AEEB3F3E04B90A685413FB292362CF122028DB53C7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.2
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### 宝塔 DV TLS ECC CA 2025

- Subject: countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 DV TLS ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 4AA699AA21475BA4699441828D22CDCED5D5C276
- SHA-256: 02918B3CF1C362A12B07DE08E61C886693B4CE5C83FFA46936CB50FB9057B3FF
- SPKI SHA-256: 47D4CD07EB2BD39B545C2A6CE54D627E5C2DF11DEAE546D2A88F6B6282110BA9
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/BaoTaDVTLSECCCA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4a:a6:99:aa:21:47:5b:a4:69:94:41:82:8d:22:cd:ce:d5:d5:c2:76
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:07:46 2025 GMT
            Not After : Oct 21 06:07:45 2030 GMT
        Subject: C = CN, O = \E5\B9\BF\E4\B8\9C\E5\A0\A1\E5\A1\94\E5\AE\89\E5\85\A8\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = \E5\AE\9D\E5\A1\94 DV TLS ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                D7:FA:4E:56:46:35:AA:82:5C:91:77:7A:70:1B:A2:D4:40:97:FE:19
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 02918B3CF1C362A12B07DE08E61C886693B4CE5C83FFA46936CB50FB9057B3FF
    SPKI SHA256: 47D4CD07EB2BD39B545C2A6CE54D627E5C2DF11DEAE546D2A88F6B6282110BA9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### 宝塔 DV TLS RSA CA 2025

- Subject: countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 DV TLS RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 7BC117442BAD4C9FB02E6229059D68BB416A0EE3
- SHA-256: E85A05DE3274CEAB9F2BA4CE9297CABD81674F6DC62CF385E40BFE0A408630D7
- SPKI SHA-256: BBBC907D6773B422E4F71AAAE1BD2DCE0EFC712E17389BF74F2250845295A648
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/BaoTaDVTLSRSACA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:c1:17:44:2b:ad:4c:9f:b0:2e:62:29:05:9d:68:bb:41:6a:0e:e3
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:07:51 2025 GMT
            Not After : Oct 21 06:07:50 2030 GMT
        Subject: C = CN, O = \E5\B9\BF\E4\B8\9C\E5\A0\A1\E5\A1\94\E5\AE\89\E5\85\A8\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = \E5\AE\9D\E5\A1\94 DV TLS RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                30:DE:87:D0:6F:4C:87:9D:EA:0F:95:2F:9A:E4:E9:3D:DE:C0:8F:17
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E85A05DE3274CEAB9F2BA4CE9297CABD81674F6DC62CF385E40BFE0A408630D7
    SPKI SHA256: BBBC907D6773B422E4F71AAAE1BD2DCE0EFC712E17389BF74F2250845295A648
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.23.140.1.2.1
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### 宝塔 TLS ECC CA 2025

- Subject: countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 TLS ECC CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS ECC Root CA
- Serial: 12D318B536BBCF906B4B2CBABC8583EF961B8457
- SHA-256: 93582DD97B62EFBE54F6F435EE88C7129D01A7054FB3FBB818934FF674028959
- SPKI SHA-256: 389982D810077C45E26C3AB0D819BF5163F3581A1E9D78CFAFF3D5505D330A1F
- Validity: 2025-10-21 to 2030-10-21
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/BaoTaTLSECCCA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:d3:18:b5:36:bb:cf:90:6b:4b:2c:ba:bc:85:83:ef:96:1b:84:57
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS ECC Root CA
        Validity
            Not Before: Oct 21 06:13:58 2025 GMT
            Not After : Oct 21 06:13:57 2030 GMT
        Subject: C = CN, O = \E5\B9\BF\E4\B8\9C\E5\A0\A1\E5\A1\94\E5\AE\89\E5\85\A8\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = \E5\AE\9D\E5\A1\94 TLS ECC CA 2025
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                2C:85:53:BB:B1:43:CD:32:EA:9E:A3:87:FE:A2:98:A8:A6:93:E9:10
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
            X509v3 Subject Key Identifier:
                A6:08:07:83:4F:7E:0B:0F:D0:7E:4D:EF:D3:12:7C:D8:7D:85:49:03
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 93582DD97B62EFBE54F6F435EE88C7129D01A7054FB3FBB818934FF674028959
    SPKI SHA256: 389982D810077C45E26C3AB0D819BF5163F3581A1E9D78CFAFF3D5505D330A1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSECCRootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSECCRootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSECCRootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### 宝塔 TLS RSA CA 2025

- Subject: countryName=CN, organizationName=广东堡塔安全技术有限公司, commonName=宝塔 TLS RSA CA 2025
- Issuer: countryName=CN, organizationName=TrustAsia Technologies, Inc., commonName=TrustAsia TLS RSA Root CA
- Serial: 580A99CCC669A6C5DF38A0C51EDD6C152391FBCF
- SHA-256: A38B6509D5EEC4E7C91DABAC460D30A75D2B408C86D2BBC7D45463815844CD40
- SPKI SHA-256: 142F2CD4346C0AD0BE4D959ED21CDD336FA10B11AE681243C0B46DB9AA314647
- Validity: 2025-10-21 to 2030-10-21
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.oem.trustca.net/BaoTaTLSRSACA2025.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- CRL DP: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:0a:99:cc:c6:69:a6:c5:df:38:a0:c5:1e:dd:6c:15:23:91:fb:cf
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = CN, O = "TrustAsia Technologies, Inc.", CN = TrustAsia TLS RSA Root CA
        Validity
            Not Before: Oct 21 06:08:11 2025 GMT
            Not After : Oct 21 06:08:10 2030 GMT
        Subject: C = CN, O = \E5\B9\BF\E4\B8\9C\E5\A0\A1\E5\A1\94\E5\AE\89\E5\85\A8\E6\8A\80\E6\9C\AF\E6\9C\89\E9\99\90\E5\85\AC\E5\8F\B8, CN = \E5\AE\9D\E5\A1\94 TLS RSA CA 2025
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Authority Key Identifier:
                B8:07:91:79:5C:06:F4:46:FD:7B:59:CA:5A:26:91:A7:45:2B:F8:53
            Authority Information Access:
                CA Issuers - URI:http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
                OCSP - URI:http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
            X509v3 Subject Key Identifier:
                22:C6:EB:AB:AA:39:FE:A8:5B:8C:A1:03:57:89:A8:E4:65:FF:AE:4D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A38B6509D5EEC4E7C91DABAC460D30A75D2B408C86D2BBC7D45463815844CD40
    SPKI SHA256: 142F2CD4346C0AD0BE4D959ED21CDD336FA10B11AE681243C0B46DB9AA314647
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.oem.trustca.net/TrustAsiaTLSRSARootCA
- AIA CA Issuers: http://ica.oem.trustca.net/TrustAsiaTLSRSARootCA.crt
- CRL Distribution Points: http://crl.oem.trustca.net/TrustAsiaTLSRSARootCA.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_any_policy
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
