# CA Owner Audit Dump - eMudhra Technologies Limited

Generated: 2026-07-28T05:57:20.699151Z

## CA Owner Summary

- Name: eMudhra Technologies Limited
- Country: India
- Website: -
- Problem Reporting: problem-reporting[at]emsign[dot]com
- CP/CPS URLs: https://repository.emsign.com/cps/CP-CPS-v1.24.md, https://repository.emsign.com/cps/CP-CPS-v1.23.md, https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.06.md, https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf, https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.05.md, https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md, https://repository.emsign.com/cps/incommon/InCommon-IGTF-SSL-CPS-v3.02.md
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Root Programs: {"mozilla":"Included","chrome":"Removed","microsoft":"Included","apple":"Not Included"}

## Owner Disclosure Snapshot

- Problem reporting mechanism: problem-reporting[at]emsign[dot]com
- CP/CPS URLs: https://repository.emsign.com/cps/CP-CPS-v1.24.md, https://repository.emsign.com/cps/CP-CPS-v1.23.md, https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.06.md, https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf, https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.05.md, https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md, https://repository.emsign.com/cps/incommon/InCommon-IGTF-SSL-CPS-v3.02.md
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Repository URLs: https://repository.emsign.com
- Root programs: {"mozilla":"Included","chrome":"Removed","microsoft":"Included","apple":"Not Included"}
- Contact aliases: -

## Certificate Inventory

| # | Subject | CA | Lifecycle | Validity | Policies | pathLen | EKU | zlint |
|---|---|---|---|---|---|---|---|---|
| 1 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3 | yes | unknown | 2018-02-18 to 2043-02-18 | - | - | - | clean |
| 2 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3 | yes | unknown | 2018-02-18 to 2043-02-18 | - | - | - | clean |
| 3 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1 | yes | unknown | 2018-02-18 to 2043-02-18 | - | - | - | clean |
| 4 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C2 | yes | unknown | 2018-02-18 to 2043-02-18 | - | - | - | clean |
| 5 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1 | yes | unknown | 2018-02-18 to 2043-02-18 | - | - | - | clean |
| 6 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2 | yes | unknown | 2018-02-18 to 2043-02-18 | - | - | - | clean |
| 7 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G1 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | clean |
| 8 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G3 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | current errors: 1 |
| 9 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | clean |
| 10 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | current errors: 1 |
| 11 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G1 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | clean |
| 12 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G3 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | current errors: 1 |
| 13 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | clean |
| 14 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | current errors: 1 |
| 15 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G2 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | clean |
| 16 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G3 | yes | unknown | 2024-02-08 to 2049-02-07 | - | - | - | current errors: 1 |
| 17 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G2A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 18 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G2A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 19 | countryName=NL, organizationName=eMudhra BV, commonName=EM DV TLS CA - G2B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 20 | countryName=US, organizationName=eMudhra Inc, commonName=EM DV TLS CA - G2C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 21 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G3A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 22 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G3A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 23 | countryName=NL, organizationName=eMudhra BV, commonName=EM DV TLS CA - G3B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 24 | countryName=US, organizationName=eMudhra Inc, commonName=EM DV TLS CA - G3C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 25 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G2A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 26 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G2A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 27 | countryName=NL, organizationName=eMudhra BV, commonName=EM EV TLS CA - G2B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 28 | countryName=US, organizationName=eMudhra Inc, commonName=EM EV TLS CA - G2C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 29 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G3A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 30 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G3A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 31 | countryName=NL, organizationName=eMudhra BV, commonName=EM EV TLS CA - G3B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 32 | countryName=US, organizationName=eMudhra Inc, commonName=EM EV TLS CA - G3C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 33 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G2A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 34 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G2A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 35 | countryName=NL, organizationName=eMudhra BV, commonName=EM OV CS CA - G2B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 36 | countryName=US, organizationName=eMudhra Inc, commonName=EM OV CS CA - G2C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 37 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G3A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 38 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G3A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 39 | countryName=NL, organizationName=eMudhra BV, commonName=EM OV CS CA - G3B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 40 | countryName=US, organizationName=eMudhra Inc, commonName=EM OV CS CA - G3C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1 | 0 | Code Signing | clean |
| 41 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G2A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 42 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G2A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 43 | countryName=NL, organizationName=eMudhra BV, commonName=EM OV TLS CA - G2B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 44 | countryName=US, organizationName=eMudhra Inc, commonName=EM OV TLS CA - G2C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 45 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G3A | yes | revoked | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | historical errors: 1 |
| 46 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G3A-1 | yes | current | 2025-05-29 to 2040-05-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 47 | countryName=NL, organizationName=eMudhra BV, commonName=EM OV TLS CA - G3B | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 48 | countryName=US, organizationName=eMudhra Inc, commonName=EM OV TLS CA - G3C | yes | current | 2025-04-30 to 2040-04-28 | 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 49 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Class 1 CA - C1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 50 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Class 1 CA - G1 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 51 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Class 2 CA - C1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 52 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Class 2 CA - G1 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 53 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Class 3 CA - C1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 54 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Class 3 CA - G1 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 55 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Client Auth CA - G1 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 56 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Client Auth CA - G3 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 57 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign CS CA - C2 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 58 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign CS CA - G2 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 59 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign CS CA - G2 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 60 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign CS CA - G3 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 61 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Device CA - C1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 62 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Device CA - G1 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 63 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Class 1 CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 64 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Class 1 CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 65 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Class 2 CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 66 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Class 2 CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 67 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Class 3 CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 68 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Class 3 CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 69 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC CS CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 70 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC CS CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 71 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Device CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | current errors: 1 |
| 72 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Device CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | - | historical errors: 1 |
| 73 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC EV CS CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 74 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC EV CS CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 75 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC EV SSL CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 76 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC EV SSL CA - G3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 77 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign ECC SMIME CA - G3 | yes | revoked | 2023-08-23 to 2038-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 78 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC SSL CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 79 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC SSL CA - G3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 80 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Time stamping CA - C3 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 81 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Time stamping CA - G3 | yes | revoked | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 82 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign EV CS CA - C2 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 83 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign EV CS CA - G2 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Code Signing | clean |
| 84 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign EV SSL CA - C1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 85 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign EV SSL CA - G1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 86 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G1 | yes | revoked | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 87 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G3 | yes | revoked | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5 | clean |
| 88 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2 | yes | current | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 89 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3 | yes | revoked | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | Code Signing | clean |
| 90 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G1 | yes | revoked | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | E-mail Protection, TLS Web Client Authentication | clean |
| 91 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G3 | yes | revoked | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | E-mail Protection, TLS Web Client Authentication | clean |
| 92 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1 | yes | current | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 93 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3 | yes | current | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 94 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G2 | yes | current | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | Time Stamping | clean |
| 95 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G3 | yes | revoked | 2024-07-11 to 2039-07-09 | 2.5.29.32.0 | 1 | Time Stamping | clean |
| 96 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign SMIME CA - G1 | yes | revoked | 2023-08-23 to 2038-08-22 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection | clean |
| 97 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign SMIME CA - G1 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | E-mail Protection, TLS Web Client Authentication | clean |
| 98 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign SMIME CA - G3 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | E-mail Protection, TLS Web Client Authentication | clean |
| 99 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign SSL CA - C1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 100 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign SSL CA - G1 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 101 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Time Stamping CA - C1 | yes | current | 2020-08-12 to 2035-08-12 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 102 | countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Time Stamping CA - C2 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 103 | countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Time Stamping CA - G2 | yes | current | 2018-02-18 to 2033-02-18 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 104 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TLS CA - G1 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | clean |
| 105 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TLS CA - G3 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | TLS Web Server Authentication, TLS Web Client Authentication | current errors: 1 |
| 106 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TSA CA - G2 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 107 | countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TSA CA - G3 | yes | current | 2024-07-11 to 2039-07-08 | 2.5.29.32.0 | 0 | Time Stamping | clean |
| 108 | countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - DVG2C | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | clean |
| 109 | countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - DVG3C | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 110 | countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - EVG2C | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication | clean |
| 111 | countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - EVG3C | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1 | 0 | TLS Web Server Authentication | current errors: 1 |
| 112 | countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - OVG2C | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 113 | countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - OVG3C | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | current errors: 1 |
| 114 | countryName=US, organizationName=Internet2, commonName=InCommon RSA IGTF Server CA 4 | yes | current | 2026-04-08 to 2029-04-07 | 1.3.6.1.4.1.5923.1.4.3.4.3, 1.2.840.113612.5.2.2.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2 | 0 | TLS Web Server Authentication | clean |
| 115 | countryName=PE, organizationalUnitName=emSign PKI, organizationName=Soft and Net Solutions SAC, commonName=Soft-Net Secure Signing CA - C1 | yes | current | 2020-08-12 to 2035-08-12 | 2.5.29.32.0 | 0 | TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, Microsoft Smartcard Login | clean |

## Certificate Details

### emSign ECC Root CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: 7B71B68256B8127C9CA8
- SHA-256: BC4D809B15189D78DB3E1D8CF4F9726A795DA1643CA5F1358E1DDB0EDC0D7EB3
- SPKI SHA-256: EABC185C4E82D942B1A5978BA3C0181487D6B3B9974E5C49F72F6D0BD9637150
- Validity: 2018-02-18 to 2043-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.24.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?RootCAC3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Removed","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7b:71:b6:82:56:b8:12:7c:9c:a8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BC4D809B15189D78DB3E1D8CF4F9726A795DA1643CA5F1358E1DDB0EDC0D7EB3
    SPKI SHA256: EABC185C4E82D942B1A5978BA3C0181487D6B3B9974E5C49F72F6D0BD9637150
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign ECC Root CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 3CF607A968700EDA8B84
- SHA-256: 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B
- SPKI SHA-256: 8D417DB2DD8BF5E3084D1E3F196D583849D81BDD4C00C70B9D39369E96B8C782
- Validity: 2018-02-18 to 2043-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.06.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?RootCAG3.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:f6:07:a9:68:70:0e:da:8b:84
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B
    SPKI SHA256: 8D417DB2DD8BF5E3084D1E3F196D583849D81BDD4C00C70B9D39369E96B8C782
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: AECF00BAC4CF32F843B2
- SHA-256: 125609AA301DA0A249B97A8239CB6A34216F44DCAC9F3954B14292F2E8C8608F
- SPKI SHA-256: B7408B4D2BE0238BA37004DD34E276C6019BD2F24C9DB7D4980F5F6C359A4BCC
- Validity: 2018-02-18 to 2043-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.24.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?RootCAC1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Removed","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ae:cf:00:ba:c4:cf:32:f8:43:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 125609AA301DA0A249B97A8239CB6A34216F44DCAC9F3954B14292F2E8C8608F
    SPKI SHA256: B7408B4D2BE0238BA37004DD34E276C6019BD2F24C9DB7D4980F5F6C359A4BCC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root CA - C2

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C2
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C2
- Serial: 2F0AB76B0DCB4AAF2758
- SHA-256: 46CD083B47E80402028DF493960EA19C85FE851950D5165F1C7DA4FAA951E2F8
- SPKI SHA-256: 3F83A68C4E80FC3F4F487E3105AD146498E56A09A3EA223B2A2982943F5995D7
- Validity: 2018-02-18 to 2043-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?RootCAC2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2f:0a:b7:6b:0d:cb:4a:af:27:58
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                B3:F7:8A:A4:D6:0F:88:00:59:E8:51:17:4F:D5:7E:EC:86:22:81:9D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 46CD083B47E80402028DF493960EA19C85FE851950D5165F1C7DA4FAA951E2F8
    SPKI SHA256: 3F83A68C4E80FC3F4F487E3105AD146498E56A09A3EA223B2A2982943F5995D7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 31F5E4620C6C58EDD6D8
- SHA-256: 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367
- SPKI SHA-256: 376A1A7082A593DCCC20D561D119E9AB8D30F11CC321D0A37FA41F0DF284E01C
- Validity: 2018-02-18 to 2043-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.06.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?RootCAG1.crl
- Revocation status: -
- Browser status: {"apple":"Included","chrome":"Included","microsoft":"Included","mozilla":"Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            31:f5:e4:62:0c:6c:58:ed:d6:d8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367
    SPKI SHA256: 376A1A7082A593DCCC20D561D119E9AB8D30F11CC321D0A37FA41F0DF284E01C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root CA - G2

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Serial: 864DBF0FE35ED77D8ED8
- SHA-256: 1AA0C2709E831BD6E3B5129A00BA41F7EEEF020872F1E6504BF0F6C3F24F3AF3
- SPKI SHA-256: 71F8ADEEC2B58ADBDF6205C98DDE928A4254B03695193D7F9A63A9A2588095D0
- Validity: 2018-02-18 to 2043-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?RootCAG2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:4d:bf:0f:e3:5e:d7:7d:8e:d8
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2043 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                ED:EC:4D:45:61:18:28:E7:B3:23:28:11:1C:4D:A5:27:0D:5E:EC:F4
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1AA0C2709E831BD6E3B5129A00BA41F7EEEF020872F1E6504BF0F6C3F24F3AF3
    SPKI SHA256: 71F8ADEEC2B58ADBDF6205C98DDE928A4254B03695193D7F9A63A9A2588095D0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root Client Auth CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G1
- Serial: 0E4FA878FEA8183E7107189595046D84
- SHA-256: 8ABFC40FAEAF13CBC8BB67B61C8D097A321CD2FEE047C54256927E0F8BFEADFD
- SPKI SHA-256: B5EE1C904AC2AAE39C92601AB466269C0C1CD0B96BADBD251B0ED88E6C4DED68
- Validity: 2024-02-08 to 2049-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.24.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?rootclientauthcag1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:4f:a8:78:fe:a8:18:3e:71:07:18:95:95:04:6d:84
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G1
        Validity
            Not Before: Feb  8 08:05:22 2024 GMT
            Not After : Feb  7 08:05:22 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DB:57:7B:CE:B1:85:DE:3A:4E:AF:C6:27:40:23:6F:55:11:14:45:24
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 8ABFC40FAEAF13CBC8BB67B61C8D097A321CD2FEE047C54256927E0F8BFEADFD
    SPKI SHA256: B5EE1C904AC2AAE39C92601AB466269C0C1CD0B96BADBD251B0ED88E6C4DED68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root Client Auth CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G3
- Serial: 0C514FFD18852863D2AAB9B7006346DF
- SHA-256: BBD8B3D745EFB79198D93B9C482B9D934537325729EA2F02C129261F91BE2E3D
- SPKI SHA-256: 8DD3D055A7F47FFBCA287285DCFD201DDE92823CCC484D30F11CC40F079B3A3E
- Validity: 2024-02-08 to 2049-02-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.24.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?rootclientauthcag3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:51:4f:fd:18:85:28:63:d2:aa:b9:b7:00:63:46:df
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G3
        Validity
            Not Before: Feb  8 08:26:56 2024 GMT
            Not After : Feb  7 08:26:56 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                49:F5:CF:F7:0D:58:CF:9E:81:71:78:8A:AC:39:3E:93:C6:3E:E6:F2
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BBD8B3D745EFB79198D93B9C482B9D934537325729EA2F02C129261F91BE2E3D
    SPKI SHA256: 8DD3D055A7F47FFBCA287285DCFD201DDE92823CCC484D30F11CC40F079B3A3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root CS CA - G2

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Serial: 0886217572A7C40CC3BB2EE5D72D6E6C
- SHA-256: 0D74EF67C88DE3560365E225AEF976F915E901347B73352D81AB5B4132BB2150
- SPKI SHA-256: 941EA0CBCE0926D9F34EC667CEE669B61FD39F4338FA0B91048D5749D8880D25
- Validity: 2024-02-08 to 2049-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?rootcscag2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:86:21:75:72:a7:c4:0c:c3:bb:2e:e5:d7:2d:6e:6c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Validity
            Not Before: Feb  8 08:15:39 2024 GMT
            Not After : Feb  7 08:15:39 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0D74EF67C88DE3560365E225AEF976F915E901347B73352D81AB5B4132BB2150
    SPKI SHA256: 941EA0CBCE0926D9F34EC667CEE669B61FD39F4338FA0B91048D5749D8880D25
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root CS CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Serial: 018FCEC927C116F59C997EDC0CCD2E2B
- SHA-256: F2EDAAFF3D9B701FB4D14C9F285F8C0BAD90FC3BCC1FA07D47F4718EDABA34A5
- SPKI SHA-256: 0A6C2B2CA5B364207954171987AC9D2178561569D8205457E77CA90C32EDE282
- Validity: 2024-02-08 to 2049-02-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=895ed837-708e-421d-bf05-7f6e56b8197a
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?rootcscag3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8f:ce:c9:27:c1:16:f5:9c:99:7e:dc:0c:cd:2e:2b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Validity
            Not Before: Feb  8 08:33:14 2024 GMT
            Not After : Feb  7 08:33:14 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F2EDAAFF3D9B701FB4D14C9F285F8C0BAD90FC3BCC1FA07D47F4718EDABA34A5
    SPKI SHA256: 0A6C2B2CA5B364207954171987AC9D2178561569D8205457E77CA90C32EDE282
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root SMIME CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G1
- Serial: 0C974F5F068B868F52FC0CF7E5544F51
- SHA-256: 47911BC8F32A11B029E0BB10A348B459404B87731B870A2F3FA97B4705DC4C25
- SPKI SHA-256: 33836758BD871B8D464BD669B0B81832880B81E363FB8CBB21BA8E843A138858
- Validity: 2024-02-08 to 2049-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.24.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?rootsmimecag1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:97:4f:5f:06:8b:86:8f:52:fc:0c:f7:e5:54:4f:51
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G1
        Validity
            Not Before: Feb  8 07:57:36 2024 GMT
            Not After : Feb  7 07:57:36 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                75:6C:0C:20:36:DB:1C:88:D4:25:BE:B7:FA:69:D3:B1:8E:6C:A7:AB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 47911BC8F32A11B029E0BB10A348B459404B87731B870A2F3FA97B4705DC4C25
    SPKI SHA256: 33836758BD871B8D464BD669B0B81832880B81E363FB8CBB21BA8E843A138858
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root SMIME CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G3
- Serial: 9F4F5FF84A1A6DC2C83C0EF9B7031F
- SHA-256: F76A0D440C418DC5B362BE8E11E0A5D06023F4396093E4F455827BF55153D8A4
- SPKI SHA-256: 5DA77DC800F4C6FA93C6015AA6BD898FDB7C28D869E764571B25C00375A77755
- Validity: 2024-02-08 to 2049-02-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/CP-CPS-v1.24.md; https://repository.emsign.com/cps/CP-CPS-v1.23.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=a5cff875-dc7c-4407-b270-4f86965ac8df
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?rootsmimecag3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9f:4f:5f:f8:4a:1a:6d:c2:c8:3c:0e:f9:b7:03:1f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G3
        Validity
            Not Before: Feb  8 08:22:51 2024 GMT
            Not After : Feb  7 08:22:51 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BD:B1:C0:20:F9:33:0D:B3:A3:5A:7D:C5:BE:3B:31:60:1D:65:5C:0A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F76A0D440C418DC5B362BE8E11E0A5D06023F4396093E4F455827BF55153D8A4
    SPKI SHA256: 5DA77DC800F4C6FA93C6015AA6BD898FDB7C28D869E764571B25C00375A77755
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root TLS CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 02A27D4E346AEF4E4F04678B5BB6D9EE
- SHA-256: CEF71E70B7C29ADDF6C30CD19E614B38FD5F02A435A0EEDDD0087E183D101A51
- SPKI SHA-256: ECE28E35289CE8621C72407949E5050052AD4607CC332EAF9B546029AACBFB7A
- Validity: 2024-02-08 to 2049-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.06.md; https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.05.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?roottlscag1.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            02:a2:7d:4e:34:6a:ef:4e:4f:04:67:8b:5b:b6:d9:ee
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Feb  8 07:45:41 2024 GMT
            Not After : Feb  7 07:45:41 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: CEF71E70B7C29ADDF6C30CD19E614B38FD5F02A435A0EEDDD0087E183D101A51
    SPKI SHA256: ECE28E35289CE8621C72407949E5050052AD4607CC332EAF9B546029AACBFB7A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root TLS CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 0E760672F143459FC8FE0AB0BC05E394
- SHA-256: 7DD78D5F4F13459A83DFF9ABBBA62EDBAF6F2D102BF257FD712F4D9F2746ED8D
- SPKI SHA-256: C619E4780ED8E0ABEDA24AD732567DE4383A7EA941338F6D1A7D1B49AC792FE9
- Validity: 2024-02-08 to 2049-02-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.06.md; https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.05.md
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=6444f3a4-f604-4336-938e-a4985d4d2474, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=07374f3b-d286-45a5-a989-6f9640f94994
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?roottlscag3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:76:06:72:f1:43:45:9f:c8:fe:0a:b0:bc:05:e3:94
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Feb  8 08:19:32 2024 GMT
            Not After : Feb  7 08:19:32 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7DD78D5F4F13459A83DFF9ABBBA62EDBAF6F2D102BF257FD712F4D9F2746ED8D
    SPKI SHA256: C619E4780ED8E0ABEDA24AD732567DE4383A7EA941338F6D1A7D1B49AC792FE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root TSA CA - G2

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G2
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G2
- Serial: 065E0E80658A572E5EBDBF93A493E350
- SHA-256: 1997770A5633FB6D0440ABF7D7E87E15D795F094F8C2959DADB00E785866BF48
- SPKI SHA-256: 1CBBD4CB5EEC6A287E34636C07C78378FA3EB3C6D3FB0563286870F283D87034
- Validity: 2024-02-08 to 2049-02-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?roottsacag2.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            06:5e:0e:80:65:8a:57:2e:5e:bd:bf:93:a4:93:e3:50
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G2
        Validity
            Not Before: Feb  8 08:11:26 2024 GMT
            Not After : Feb  7 08:11:26 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FA:22:B0:1A:0E:0F:07:13:23:7A:38:FC:D0:37:31:36:88:D8:38:25
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 1997770A5633FB6D0440ABF7D7E87E15D795F094F8C2959DADB00E785866BF48
    SPKI SHA256: 1CBBD4CB5EEC6A287E34636C07C78378FA3EB3C6D3FB0563286870F283D87034
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### emSign Root TSA CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G3
- Serial: 0E27F07F8657096CCFD447EA0E2399EC
- SHA-256: 75D2CE75979CF2A43B172C9F89F733DDA2136031DB4BBF3698B053714C077155
- SPKI SHA-256: 11567F2AAF4325C4044880C6ED2B37F1CA2586D87059CF254934D97C4FEE89A5
- Validity: 2024-02-08 to 2049-02-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/codesigning/Code-Signing-CP-CPS-v1.01.pdf
- CP/CPS same as parent: false
- Audit URLs: https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=41e40cb2-f813-4ab0-8200-d7b687606270, https://www.cpacanada.ca/api/getPDFWebTrust?attachmentId=2fc9571e-aabc-44c0-a994-786ed27d4713
- Audit same as parent: false
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?roottsacag3.crl
- Revocation status: -
- Browser status: {"apple":"Not Included","chrome":"Not Included","microsoft":"Included","mozilla":"Not Yet Included"}
- Certificate type: Root Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: -
- Currently valid: -
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: -
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: false
- AIA OCSP: -
- CRL DP: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:27:f0:7f:86:57:09:6c:cf:d4:47:ea:0e:23:99:ec
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G3
        Validity
            Not Before: Feb  8 08:30:04 2024 GMT
            Not After : Feb  7 08:30:04 2049 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                40:C9:21:8A:78:42:45:B9:88:B1:EE:CA:C1:F6:68:F5:6A:09:33:B7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 75D2CE75979CF2A43B172C9F89F733DDA2136031DB4BBF3698B053714C077155
    SPKI SHA256: 11567F2AAF4325C4044880C6ED2B37F1CA2586D87059CF254934D97C4FEE89A5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":null}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: -
- AIA OCSP: -
- AIA CA Issuers: -
- CRL Distribution Points: -
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_root_ca
- is_self_signed
- has_basic_constraints
- is_ca
- has_key_usage

### EM DV TLS CA - G2A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G2A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 43ABB4B2E3968FB8B71FC7D2FC375F
- SHA-256: D6961022F9A55BBDE793D1BC696D73D7C2569AD55F0FD59910AF45449CD9CAB6
- SPKI SHA-256: FFF112FC55C9D5B2616A45455C326D290A17D38F06EC21116D624425DA822728
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG2A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:ab:b4:b2:e3:96:8f:b8:b7:1f:c7:d2:fc:37:5f
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 09:30:57 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM DV TLS CA - G2A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                D7:C4:F1:10:FD:90:61:67:A2:B4:8C:A2:08:32:01:B5:D0:35:1B:DC
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG2A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D6961022F9A55BBDE793D1BC696D73D7C2569AD55F0FD59910AF45449CD9CAB6
    SPKI SHA256: FFF112FC55C9D5B2616A45455C326D290A17D38F06EC21116D624425DA822728
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG2A.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G2A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G2A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: B6391A6D28C7886AE6FCCED2F3C1A7
- SHA-256: 3F13597D3355D341BD09328AEE567D7F4E002D9919B986F9962DAFF197EA75D1
- SPKI SHA-256: CEB5298DAEB8F59279480B46002C89F7755CC3A169514B11B810BEFC195A00D8
- Validity: 2025-05-29 to 2040-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG2A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b6:39:1a:6d:28:c7:88:6a:e6:fc:ce:d2:f3:c1:a7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: May 29 07:16:12 2025 GMT
            Not After : May 28 07:16:12 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM DV TLS CA - G2A-1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                13:5C:1E:18:96:0D:03:79:CB:04:09:AF:8F:9D:14:D0:2E:B6:DB:70
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG2A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 3F13597D3355D341BD09328AEE567D7F4E002D9919B986F9962DAFF197EA75D1
    SPKI SHA256: CEB5298DAEB8F59279480B46002C89F7755CC3A169514B11B810BEFC195A00D8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG2A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G2B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM DV TLS CA - G2B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: F0A030825E22BB2E1D88E3889DC073
- SHA-256: 829EC444B8BE3DFD2D030A0D9E7A1D0DD2A3C2C325D39589C27AC9A065BAE793
- SPKI SHA-256: 04DB3B7DDF683B1D4B5B64FE743A3A8D8C3D71F0C339D7DC25B343E665A9EB5B
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG2B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f0:a0:30:82:5e:22:bb:2e:1d:88:e3:88:9d:c0:73
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 15:46:17 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM DV TLS CA - G2B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                8B:65:AF:C7:2B:3C:0C:7E:D1:05:B5:07:E2:58:12:A8:66:15:28:76
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG2B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 829EC444B8BE3DFD2D030A0D9E7A1D0DD2A3C2C325D39589C27AC9A065BAE793
    SPKI SHA256: 04DB3B7DDF683B1D4B5B64FE743A3A8D8C3D71F0C339D7DC25B343E665A9EB5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG2B.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G2C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM DV TLS CA - G2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: AB5DEA38BDC920D5FA4736DA54BEBE
- SHA-256: 0427EA3CB4A7B4CB205E77A7B166D332BEDB8E8EF469BC5E883169C8D0AC876D
- SPKI SHA-256: 34556838281688D1C967D43D1372A1BBAF389277222F03E1017B18B348A1F00E
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com?EMDVTLSCAG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ab:5d:ea:38:bd:c9:20:d5:fa:47:36:da:54:be:be
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 14:24:24 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM DV TLS CA - G2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                F5:45:10:40:1A:21:00:33:C3:9E:86:3A:67:8B:FB:8F:7B:6A:C0:48
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 0427EA3CB4A7B4CB205E77A7B166D332BEDB8E8EF469BC5E883169C8D0AC876D
    SPKI SHA256: 34556838281688D1C967D43D1372A1BBAF389277222F03E1017B18B348A1F00E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G3A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G3A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 217B2D6D167EC0A6A9FA3E0B283311
- SHA-256: C83980CF0440CDEA950BE2C13CC1090F04B8D77E0D50E977588DBDDB11CC6DA9
- SPKI SHA-256: D45CE41F3B285436B8FD3E2B68E500F2835DD737035F2BCC489E9E48CF0CCCD8
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG3A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:7b:2d:6d:16:7e:c0:a6:a9:fa:3e:0b:28:33:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 09:48:44 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM DV TLS CA - G3A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                F6:E3:DC:04:A1:3F:F4:E0:6D:94:92:C7:3E:B0:79:DB:B8:B2:9A:4F
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG3A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C83980CF0440CDEA950BE2C13CC1090F04B8D77E0D50E977588DBDDB11CC6DA9
    SPKI SHA256: D45CE41F3B285436B8FD3E2B68E500F2835DD737035F2BCC489E9E48CF0CCCD8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG3A.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G3A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM DV TLS CA - G3A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: A3E5AD9D0C0374A342E5E2A3F506DD
- SHA-256: 4896D51F6537A5326272C412BC75990E15D4F5ECDC2946C19776923B8E169E93
- SPKI SHA-256: 2FF90B0E2BD10089C13500A8CB86BEE9027F7A71F12A1C074AA07BB8A08E2724
- Validity: 2025-05-29 to 2040-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG3A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a3:e5:ad:9d:0c:03:74:a3:42:e5:e2:a3:f5:06:dd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: May 29 07:37:34 2025 GMT
            Not After : May 28 07:37:34 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM DV TLS CA - G3A-1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                AB:28:96:83:69:3E:C4:49:71:F5:14:8A:65:47:21:A3:70:22:B6:53
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG3A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4896D51F6537A5326272C412BC75990E15D4F5ECDC2946C19776923B8E169E93
    SPKI SHA256: 2FF90B0E2BD10089C13500A8CB86BEE9027F7A71F12A1C074AA07BB8A08E2724
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG3A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G3B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM DV TLS CA - G3B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: A4AEE678F23362B4C0E460B772F214
- SHA-256: 42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
- SPKI SHA-256: EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG3B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a4:ae:e6:78:f2:33:62:b4:c0:e4:60:b7:72:f2:14
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 15:54:08 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM DV TLS CA - G3B
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                E2:1E:2F:E7:1C:19:39:0E:55:4B:62:C1:20:24:57:35:24:8A:25:14
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG3B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
    SPKI SHA256: EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG3B.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM DV TLS CA - G3C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM DV TLS CA - G3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 588B2E3C2BB8CDA13E1A1209254321
- SHA-256: 0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
- SPKI SHA-256: 49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMDVTLSCAG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            58:8b:2e:3c:2b:b8:cd:a1:3e:1a:12:09:25:43:21
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 15:35:09 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM DV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                AE:7E:10:5C:3C:29:96:C1:A8:47:27:05:59:F1:E0:3D:D4:E5:0A:F3
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
    SPKI SHA256: 49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMDVTLSCAG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G2A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G2A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 8BAC52C0F3FFFF3149F536E6DC215A
- SHA-256: 6984C2CCC0749F56449DE150C23975EFDC4D311E90308A622C3641D5ABB4312D
- SPKI SHA-256: D16F35A2FC245C9AEA23050FB48F69240AEB2892466CF998C518139FBD0FEC0E
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG2A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8b:ac:52:c0:f3:ff:ff:31:49:f5:36:e6:dc:21:5a
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 09:43:37 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM EV TLS CA - G2A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                AB:31:82:F3:8B:F8:EE:02:74:5C:98:C1:3F:05:87:25:04:B3:C8:A5
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG2A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6984C2CCC0749F56449DE150C23975EFDC4D311E90308A622C3641D5ABB4312D
    SPKI SHA256: D16F35A2FC245C9AEA23050FB48F69240AEB2892466CF998C518139FBD0FEC0E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG2A.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G2A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G2A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 35ACF2A0E598C8E849D5EE7E724C82
- SHA-256: 684B11E56AB72502B75DACA1CD009E3DD4BEAB3AC1FE448902D272766CCA797E
- SPKI SHA-256: 27616F251B91B3DF6A241B45854A5DB0A7B1BEDD13A296F5CACB670AEAC460E5
- Validity: 2025-05-29 to 2040-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG2A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:ac:f2:a0:e5:98:c8:e8:49:d5:ee:7e:72:4c:82
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: May 29 07:26:58 2025 GMT
            Not After : May 28 07:26:58 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM EV TLS CA - G2A-1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                B7:12:2A:EF:1C:70:5E:24:4B:A3:B0:16:A5:2F:D8:FB:2A:9B:B0:D0
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG2A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 684B11E56AB72502B75DACA1CD009E3DD4BEAB3AC1FE448902D272766CCA797E
    SPKI SHA256: 27616F251B91B3DF6A241B45854A5DB0A7B1BEDD13A296F5CACB670AEAC460E5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG2A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G2B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM EV TLS CA - G2B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 8F06A3F1D6A2FC71D29393C71CD48E
- SHA-256: E072B30D7F5B8BCF0080E51D6CC7765767072DB2319E9BB1CD3D02A086898750
- SPKI SHA-256: C2690B6BF35A9364E697735EC630BFD9D2CD59040E3908A66765168E3282B04E
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG2B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8f:06:a3:f1:d6:a2:fc:71:d2:93:93:c7:1c:d4:8e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 15:52:02 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM EV TLS CA - G2B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                25:14:6F:17:75:E2:50:2F:C6:82:50:28:4A:A0:7B:EA:D4:C2:09:55
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG2B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: E072B30D7F5B8BCF0080E51D6CC7765767072DB2319E9BB1CD3D02A086898750
    SPKI SHA256: C2690B6BF35A9364E697735EC630BFD9D2CD59040E3908A66765168E3282B04E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG2B.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G2C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM EV TLS CA - G2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: B28103309375C0CBB9E9B80B66C430
- SHA-256: C3BC2B480FB1A1AB4D0BA1ED6C7B53E096447045733620991A32D6798D77AA20
- SPKI SHA-256: 1A942E3925B809896B4B291A8CD2E7BC5F1D533AA523B8353B2DF377B0F0ADBE
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com?EMEVTLSCAG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b2:81:03:30:93:75:c0:cb:b9:e9:b8:0b:66:c4:30
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 14:30:28 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM EV TLS CA - G2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                A2:32:BD:61:64:01:AF:70:B4:0F:A9:1F:F5:A6:33:83:89:62:4B:36
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C3BC2B480FB1A1AB4D0BA1ED6C7B53E096447045733620991A32D6798D77AA20
    SPKI SHA256: 1A942E3925B809896B4B291A8CD2E7BC5F1D533AA523B8353B2DF377B0F0ADBE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G3A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G3A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 15E599DA4E0962CBEE3926BDB98A8B
- SHA-256: 8344188BCBD9CECB9397436878DE8918D6D4521EFDB6BDE2A30E520847F22901
- SPKI SHA-256: D8AAA5319DE5242EC1734B988BDF330FEC7DBD38206CAF76656EE4836A216876
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG3A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            15:e5:99:da:4e:09:62:cb:ee:39:26:bd:b9:8a:8b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 09:57:21 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM EV TLS CA - G3A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                56:0A:58:D4:69:79:EA:13:E9:2D:4A:9F:AE:8C:0B:EF:0F:0E:95:4E
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG3A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 8344188BCBD9CECB9397436878DE8918D6D4521EFDB6BDE2A30E520847F22901
    SPKI SHA256: D8AAA5319DE5242EC1734B988BDF330FEC7DBD38206CAF76656EE4836A216876
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG3A.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G3A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM EV TLS CA - G3A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: B28971D9989A629CA9B4E206067211
- SHA-256: BA0A3DA706F47DAC1A9C33C4EE1E4D86B726EF48E70D4319F3C949EC673A1975
- SPKI SHA-256: F8DB20C2D076249967BEEA91EC27C954A5D405863E0ED1231C3B8C7F1FBFC7FF
- Validity: 2025-05-29 to 2040-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/ssl/SSL-TLS-CP-CPS-v1.05.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG3A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b2:89:71:d9:98:9a:62:9c:a9:b4:e2:06:06:72:11
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: May 29 07:44:09 2025 GMT
            Not After : May 28 07:44:09 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM EV TLS CA - G3A-1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                4A:BA:B8:73:55:C2:6A:1B:F9:F6:00:BB:6E:B2:62:15:7E:C7:0B:12
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG3A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: BA0A3DA706F47DAC1A9C33C4EE1E4D86B726EF48E70D4319F3C949EC673A1975
    SPKI SHA256: F8DB20C2D076249967BEEA91EC27C954A5D405863E0ED1231C3B8C7F1FBFC7FF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG3A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G3B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM EV TLS CA - G3B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: C7C41EFE92D825F05EAE841A4A82C1
- SHA-256: E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
- SPKI SHA-256: E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG3B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c7:c4:1e:fe:92:d8:25:f0:5e:ae:84:1a:4a:82:c1
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 16:03:31 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM EV TLS CA - G3B
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                3E:DC:20:D9:89:46:98:87:7B:87:3F:D8:81:47:B2:5C:15:D8:47:06
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG3B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
    SPKI SHA256: E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG3B.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM EV TLS CA - G3C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM EV TLS CA - G3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 8009928A64107601AF05FA2F19F109
- SHA-256: 432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
- SPKI SHA-256: 5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMEVTLSCAG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            80:09:92:8a:64:10:76:01:af:05:fa:2f:19:f1:09
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 15:39:31 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM EV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                A6:25:5E:80:A9:4D:B7:F3:96:7C:1B:C7:91:DF:92:BC:EE:4B:EB:5F
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
    SPKI SHA256: 5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMEVTLSCAG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G2A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G2A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Serial: C5649D321D7AF979AEF1A1900BACAF
- SHA-256: D5B4A8E4B3E881B6747FDD8A8E8996CD194C016F18BD745FE9F5E09E6B2F23B6
- SPKI SHA-256: 6CA6B0E819309539B9627E00AA70D74A0919800F8F217E6197FB6946989ED264
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG2A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c5:64:9d:32:1d:7a:f9:79:ae:f1:a1:90:0b:ac:af
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Validity
            Not Before: Apr 30 10:02:43 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV CS CA - G2A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Subject Key Identifier:
                C3:89:B8:96:EF:88:35:51:98:22:86:84:BD:94:60:D6:73:B5:3D:2A
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG2A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D5B4A8E4B3E881B6747FDD8A8E8996CD194C016F18BD745FE9F5E09E6B2F23B6
    SPKI SHA256: 6CA6B0E819309539B9627E00AA70D74A0919800F8F217E6197FB6946989ED264
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG2A.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G2A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G2A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Serial: FF1E75860CB7DEBF1579A77837AA90
- SHA-256: 6CE3E43327FD6694707C1B87346E26F0BBDAE808744D39821BE530FE90C1D310
- SPKI SHA-256: 12DD68CD491523B8E627AB6F192D32D6CBB3655275C17AFA61BC511E7CA34D4C
- Validity: 2025-05-29 to 2040-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG2A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ff:1e:75:86:0c:b7:de:bf:15:79:a7:78:37:aa:90
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Validity
            Not Before: May 29 07:47:41 2025 GMT
            Not After : May 28 07:47:41 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV CS CA - G2A-1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Subject Key Identifier:
                F9:C0:BC:F1:50:CB:FC:66:E7:67:73:E3:CD:C9:60:48:ED:DE:D9:0E
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG2A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6CE3E43327FD6694707C1B87346E26F0BBDAE808744D39821BE530FE90C1D310
    SPKI SHA256: 12DD68CD491523B8E627AB6F192D32D6CBB3655275C17AFA61BC511E7CA34D4C
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG2A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G2B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM OV CS CA - G2B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Serial: 33E8C5A8046D443E8FA5F1AF733188
- SHA-256: 913F1A04B02814B604AC5275ACB201B1C802B2C0F1B4986FB1A1EB595958E072
- SPKI SHA-256: 0169613548123DAB14AFFFCB5A3F0E804C70AC903F29ECAD55ED43DC75F13881
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG2B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:e8:c5:a8:04:6d:44:3e:8f:a5:f1:af:73:31:88
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Validity
            Not Before: Apr 30 16:06:08 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM OV CS CA - G2B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Subject Key Identifier:
                8A:F8:C1:B0:F8:65:0C:EA:0D:3E:52:A4:79:6C:69:88:F1:C8:58:1D
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG2B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 913F1A04B02814B604AC5275ACB201B1C802B2C0F1B4986FB1A1EB595958E072
    SPKI SHA256: 0169613548123DAB14AFFFCB5A3F0E804C70AC903F29ECAD55ED43DC75F13881
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG2B.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G2C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM OV CS CA - G2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Serial: 7F7C7D863DC9B3541E9D0C4B91237E
- SHA-256: EBAC91B8EC9853323779EDB393C595FADB29DD4DDB20C47E336F2A021684F27B
- SPKI SHA-256: C073EFB31422FF4DB99DC24D7442438E942C73CD3C61B529A8BA32542E946B86
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7f:7c:7d:86:3d:c9:b3:54:1e:9d:0c:4b:91:23:7e
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Validity
            Not Before: Apr 30 15:42:10 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM OV CS CA - G2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Subject Key Identifier:
                0B:05:FE:F0:70:1C:D2:3C:F7:F5:31:D9:DF:73:31:E2:D4:A9:EF:D2
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: EBAC91B8EC9853323779EDB393C595FADB29DD4DDB20C47E336F2A021684F27B
    SPKI SHA256: C073EFB31422FF4DB99DC24D7442438E942C73CD3C61B529A8BA32542E946B86
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G3A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G3A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Serial: AC7B64AF707A1E1422A2A868B754E2
- SHA-256: 4FFC3046410087C23D2873CD947C8C25422114254BC1567D4C33F35723EBA93B
- SPKI SHA-256: 4E8B3000146768D220E3B7FBC2BD2F46BFB3F76C563F82F0AB8A9B2563EEEF00
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG3A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ac:7b:64:af:70:7a:1e:14:22:a2:a8:68:b7:54:e2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Validity
            Not Before: Apr 30 10:05:52 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV CS CA - G3A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Subject Key Identifier:
                31:06:04:C5:0B:1C:C9:30:68:7F:42:49:42:FB:1D:9B:FB:C1:79:C0
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG3A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4FFC3046410087C23D2873CD947C8C25422114254BC1567D4C33F35723EBA93B
    SPKI SHA256: 4E8B3000146768D220E3B7FBC2BD2F46BFB3F76C563F82F0AB8A9B2563EEEF00
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG3A.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G3A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV CS CA - G3A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Serial: 2C0D3D93C650F771B32541B78920D2
- SHA-256: F3E525E51E2BB27CAB003D874566B0B7762B7EAC5BEBC8CDDFDFF8B26AD430C3
- SPKI SHA-256: C6FD1E9191185D5E2A09FC5D35674E0292B54ED426A98E3DC91B98443B186F0A
- Validity: 2025-05-29 to 2040-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG3A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2c:0d:3d:93:c6:50:f7:71:b3:25:41:b7:89:20:d2
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Validity
            Not Before: May 29 07:49:38 2025 GMT
            Not After : May 28 07:49:38 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV CS CA - G3A-1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Subject Key Identifier:
                0C:76:C9:61:41:89:8F:D8:5A:FB:34:8B:EF:11:19:07:1D:07:1C:6D
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG3A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F3E525E51E2BB27CAB003D874566B0B7762B7EAC5BEBC8CDDFDFF8B26AD430C3
    SPKI SHA256: C6FD1E9191185D5E2A09FC5D35674E0292B54ED426A98E3DC91B98443B186F0A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG3A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G3B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM OV CS CA - G3B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Serial: 7818933F8F85B4619A2B35FBA83D0A
- SHA-256: 9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
- SPKI SHA-256: EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG3B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            78:18:93:3f:8f:85:b4:61:9a:2b:35:fb:a8:3d:0a
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Validity
            Not Before: Apr 30 16:08:27 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM OV CS CA - G3B
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Subject Key Identifier:
                79:FA:E8:EC:CF:DB:0D:75:8D:A4:58:D6:9F:B6:ED:DC:7C:49:DE:E6
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG3B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
    SPKI SHA256: EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG3B.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV CS CA - G3C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM OV CS CA - G3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Serial: 544B7F922C31AE220A4A922916F6E6
- SHA-256: 4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
- SPKI SHA-256: 92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVCSCAG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- anyPolicy: false
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:4b:7f:92:2c:31:ae:22:0a:4a:92:29:16:f6:e6
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Validity
            Not Before: Apr 30 16:38:40 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM OV CS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Subject Key Identifier:
                EE:6F:73:29:8D:6F:BF:A7:B3:1B:C3:95:34:F6:15:56:44:78:66:B7
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.200
                Policy: 2.23.140.1.4.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVCSCAG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
    SPKI SHA256: 92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.200, 2.23.140.1.4.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVCSCAG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G2A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G2A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 2462D9884FBF5622339FC366B84B73
- SHA-256: F95D99B74A0FC39B8FF1316523B0E99F514A8187BB94540EBAEBA636D4E42121
- SPKI SHA-256: DAA9724DA8E1FE403ABA0B412467DB4E4B376C631EEA8DCEA4960929F4AEB9B8
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG2A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            24:62:d9:88:4f:bf:56:22:33:9f:c3:66:b8:4b:73
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 09:40:31 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV TLS CA - G2A
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                32:F2:D6:1F:DC:F2:2D:BB:3F:A0:21:27:DF:66:F2:A8:FC:A9:3A:A9
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG2A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F95D99B74A0FC39B8FF1316523B0E99F514A8187BB94540EBAEBA636D4E42121
    SPKI SHA256: DAA9724DA8E1FE403ABA0B412467DB4E4B376C631EEA8DCEA4960929F4AEB9B8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG2A.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G2A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G2A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 59491409E797EA968F05E0FF331FEC
- SHA-256: 291804EC866837CD5AF5F4D652F1DCC79BEC622D4F9BF4870E5E4D8639DF3AD4
- SPKI SHA-256: 8C7870D7E1C55D0F06D77DB49843EFAF017371B7E28F4A71241FF1746F04A5FC
- Validity: 2025-05-29 to 2040-05-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG2A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            59:49:14:09:e7:97:ea:96:8f:05:e0:ff:33:1f:ec
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: May 29 07:23:41 2025 GMT
            Not After : May 28 07:23:41 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV TLS CA - G2A-1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                37:C4:D2:4A:F9:28:65:41:CE:F8:94:13:7F:20:15:EE:A7:80:5D:37
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG2A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 291804EC866837CD5AF5F4D652F1DCC79BEC622D4F9BF4870E5E4D8639DF3AD4
    SPKI SHA256: 8C7870D7E1C55D0F06D77DB49843EFAF017371B7E28F4A71241FF1746F04A5FC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG2A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G2B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM OV TLS CA - G2B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: C164DB9804F563241ED32C4100A566
- SHA-256: 6A7A93861982B664001710A0EFD04C8A72F6A23E252B280911797E0BF1BD9012
- SPKI SHA-256: 8429351035BA90BA14EF3F7AE38CA35480605A0296AA6C263C6A9B26BB9A48E1
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG2B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c1:64:db:98:04:f5:63:24:1e:d3:2c:41:00:a5:66
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 15:49:44 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM OV TLS CA - G2B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                7B:9E:19:CF:EE:02:5E:7F:7B:E7:F1:D9:50:91:21:ED:44:0D:89:0A
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG2B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 6A7A93861982B664001710A0EFD04C8A72F6A23E252B280911797E0BF1BD9012
    SPKI SHA256: 8429351035BA90BA14EF3F7AE38CA35480605A0296AA6C263C6A9B26BB9A48E1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG2B.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G2C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM OV TLS CA - G2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: CBDCFA0D64112709CF14B7E4858250
- SHA-256: DE767792E870BD32F331029FC89DC24C53F9DF970DC70F1EA30CF29DB3F94BA9
- SPKI SHA-256: AA4216DC80A7299AE6DE08444BEA2C588DC873631EBC563C0776D83A1B61E3CE
- Validity: 2025-04-30 to 2040-04-28
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com?EMOVTLSCAG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            cb:dc:fa:0d:64:11:27:09:cf:14:b7:e4:85:82:50
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr 30 14:28:01 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM OV TLS CA - G2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                74:E1:3A:A3:E8:44:37:37:72:B4:F5:F1:25:DA:05:D3:50:F6:16:2D
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DE767792E870BD32F331029FC89DC24C53F9DF970DC70F1EA30CF29DB3F94BA9
    SPKI SHA256: AA4216DC80A7299AE6DE08444BEA2C588DC873631EBC563C0776D83A1B61E3CE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G3A

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G3A
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 62F09EB8DA2043FDCD29F9FFD46460
- SHA-256: 775BB88FB7FECCCA55B5B216DF40A23F52129EF647EA2077CADDEE798DEF9EB0
- SPKI SHA-256: 32159657965E44EC9B1B7F0933475009E50479A0FAE1DFBB236A8DAD4FF7A6A6
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG3A.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:f0:9e:b8:da:20:43:fd:cd:29:f9:ff:d4:64:60
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 09:53:12 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV TLS CA - G3A
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                ED:43:BA:F6:C9:C1:9F:8D:20:23:DE:E1:48:20:32:D2:8F:D8:20:69
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG3A.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 775BB88FB7FECCCA55B5B216DF40A23F52129EF647EA2077CADDEE798DEF9EB0
    SPKI SHA256: 32159657965E44EC9B1B7F0933475009E50479A0FAE1DFBB236A8DAD4FF7A6A6
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG3A.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G3A-1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=EM OV TLS CA - G3A-1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: C5FB5F2D43071F5B5623B5D132878C
- SHA-256: 259FF0963A0665BF40D92E05E95B960CCB423DBD117482AE647BC7FD5F5CE644
- SPKI SHA-256: 4AA7E0E79901D2709E94750E98A013E64DCBDC219C23BDEA36B0AFAAEC4F12D9
- Validity: 2025-05-29 to 2040-05-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG3A1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-a.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c5:fb:5f:2d:43:07:1f:5b:56:23:b5:d1:32:87:8c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: May 29 07:41:16 2025 GMT
            Not After : May 28 07:41:16 2040 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = EM OV TLS CA - G3A-1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                06:4E:B5:99:F6:61:9B:45:B9:95:56:FE:7D:C6:A1:15:FC:D5:D1:1D
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-a.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG3A1.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 259FF0963A0665BF40D92E05E95B960CCB423DBD117482AE647BC7FD5F5CE644
    SPKI SHA256: 4AA7E0E79901D2709E94750E98A013E64DCBDC219C23BDEA36B0AFAAEC4F12D9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-a.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG3A1.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G3B

- Subject: countryName=NL, organizationName=eMudhra BV, commonName=EM OV TLS CA - G3B
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 6CADA367FB1C100088120EA202D568
- SHA-256: 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
- SPKI SHA-256: 43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG3B.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-b.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6c:ad:a3:67:fb:1c:10:00:88:12:0e:a2:02:d5:68
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 16:00:12 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = NL, O = eMudhra BV, CN = EM OV TLS CA - G3B
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                9B:D8:65:51:AF:E7:E7:2C:37:AD:08:EE:69:19:D9:BF:37:84:AE:0A
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-b.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG3B.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
    SPKI SHA256: 43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-b.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG3B.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### EM OV TLS CA - G3C

- Subject: countryName=US, organizationName=eMudhra Inc, commonName=EM OV TLS CA - G3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 296926C227A3A1526392B19482A504
- SHA-256: CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
- SPKI SHA-256: 63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8
- Validity: 2025-04-30 to 2040-04-28
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?EMOVTLSCAG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            29:69:26:c2:27:a3:a1:52:63:92:b1:94:82:a5:04
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr 30 15:37:41 2025 GMT
            Not After : Apr 28 18:30:00 2040 GMT
        Subject: C = US, O = eMudhra Inc, CN = EM OV TLS CA - G3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                34:EA:EA:0C:EB:C9:0A:DA:F9:D0:C5:E2:ED:9B:78:C9:87:9E:1B:6C
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.50977.1.0.1
                  CPS: http://repository.emsign.com
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
    SPKI SHA256: 63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 1.3.6.1.4.1.50977.1.0.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMOVTLSCAG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Class 1 CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Class 1 CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: 7E065336C075C7998B63
- SHA-256: 0EF7B863FAABC384A694FF632DAAF9BD31CED23E9246559A59ECD7472754CCE6
- SPKI SHA-256: B4665EBA997ED5F662949C2E822B5E14ADFF401AF0CC246945266F5FAB80E35B
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClass1CAC1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7e:06:53:36:c0:75:c7:99:8b:63
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Class 1 CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                3B:0E:EF:29:3B:11:48:29:2C:01:15:D1:8E:7B:79:69:05:7B:C9:52
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 0EF7B863FAABC384A694FF632DAAF9BD31CED23E9246559A59ECD7472754CCE6
    SPKI SHA256: B4665EBA997ED5F662949C2E822B5E14ADFF401AF0CC246945266F5FAB80E35B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Class 1 CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Class 1 CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: D59B7C9B36A2D44922EA
- SHA-256: CF6D0333D0BE2C69A42D453960DEE9E109D9E8843EA3061A1671D6EAF85EB7D8
- SPKI SHA-256: F1E62919C593884672332CA0D7D43D4FE6C242DEFCBC68EE24390B535D071B1F
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClass1CAG1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d5:9b:7c:9b:36:a2:d4:49:22:ea
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Class 1 CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                DC:60:8F:0A:DE:B1:99:84:9B:84:40:03:E3:75:03:32:03:80:00:90
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CF6D0333D0BE2C69A42D453960DEE9E109D9E8843EA3061A1671D6EAF85EB7D8
    SPKI SHA256: F1E62919C593884672332CA0D7D43D4FE6C242DEFCBC68EE24390B535D071B1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Class 2 CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Class 2 CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: 1A5C82DEDCBC6A153030
- SHA-256: 05B30B3FC44F8575334BD812EF9FA8A52A75743E19BC35A5BE3912ECA62C4669
- SPKI SHA-256: C12DDF9F09FA23ED1A5FE511AEF4623BB84F58F8D39E15F8BA2EAF024CED3A5B
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClass2CAC1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1a:5c:82:de:dc:bc:6a:15:30:30
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Class 2 CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                26:68:C0:F3:FC:40:1C:F7:CA:12:4B:4F:92:C3:8B:14:94:48:3B:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 05B30B3FC44F8575334BD812EF9FA8A52A75743E19BC35A5BE3912ECA62C4669
    SPKI SHA256: C12DDF9F09FA23ED1A5FE511AEF4623BB84F58F8D39E15F8BA2EAF024CED3A5B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Class 2 CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Class 2 CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 3C5BDA55C0A236A744CD
- SHA-256: 63A8369DC824A42BC7AE6EE5D26AAFD32DF4AF677CA18B941B7A57E33B1E3559
- SPKI SHA-256: DDB1222B5107B05FF2C87E641D5F6C9D83BE852FE28E28EF441092D70AEB02E7
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClass2CAG1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:5b:da:55:c0:a2:36:a7:44:cd
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Class 2 CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                E6:DD:0D:B9:9B:D2:15:40:CF:23:08:2D:6C:19:B8:5C:68:32:52:32
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 63A8369DC824A42BC7AE6EE5D26AAFD32DF4AF677CA18B941B7A57E33B1E3559
    SPKI SHA256: DDB1222B5107B05FF2C87E641D5F6C9D83BE852FE28E28EF441092D70AEB02E7
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Class 3 CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Class 3 CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: B474F64D86392189496E
- SHA-256: 69B0DD09B98F36A9CC7BD7FFE8A00DCD319A5FC947C9C8AF72C92894D8E81092
- SPKI SHA-256: D7DE9C05CE19A59F9D81CD9FF5E888CEC4C3287D5470C510925A5EAA3B7CD54F
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClass3CAC1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b4:74:f6:4d:86:39:21:89:49:6e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Class 3 CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                7B:9E:A6:C5:27:7E:64:97:AB:84:01:3A:EA:26:96:6B:92:4E:87:E1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 69B0DD09B98F36A9CC7BD7FFE8A00DCD319A5FC947C9C8AF72C92894D8E81092
    SPKI SHA256: D7DE9C05CE19A59F9D81CD9FF5E888CEC4C3287D5470C510925A5EAA3B7CD54F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Class 3 CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Class 3 CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: A08870825A326BED9611
- SHA-256: 42DA1C562F80E46DA7A321244EFC23D0FAA9FEBBB7AA0377D96B42D9E88AB200
- SPKI SHA-256: E1DDA9BB414DE47595A4F6D8BBED1C1F501E099633DDD833F5E15E634C6E4E1F
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClass3CAG1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            a0:88:70:82:5a:32:6b:ed:96:11
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Class 3 CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                5C:A5:9C:41:EF:6E:41:61:46:79:2C:DF:D8:55:45:05:D5:A7:1A:86
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 42DA1C562F80E46DA7A321244EFC23D0FAA9FEBBB7AA0377D96B42D9E88AB200
    SPKI SHA256: E1DDA9BB414DE47595A4F6D8BBED1C1F501E099633DDD833F5E15E634C6E4E1F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Client Auth CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Client Auth CA - G1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G1
- Serial: 9E351D31686B4110253502BD33810C
- SHA-256: A2F8EA7537CD5AF80D048497A432DE5907AEE52785D07061462FC511467BE720
- SPKI SHA-256: 120A54EDBB14D3CBD2B33EBF67010220374AE6C4F881DEA68937BF8BFF7174AD
- Validity: 2024-07-11 to 2039-07-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClientAuthCAG1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?rootclientauthcag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            9e:35:1d:31:68:6b:41:10:25:35:02:bd:33:81:0c
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G1
        Validity
            Not Before: Jul 11 16:30:06 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Client Auth CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                DB:57:7B:CE:B1:85:DE:3A:4E:AF:C6:27:40:23:6F:55:11:14:45:24
            X509v3 Subject Key Identifier:
                39:3F:E3:BE:51:4E:C5:F9:41:06:49:61:4E:B4:88:CA:4E:17:F2:8F
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/rootclientauthcag1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootclientauthcag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A2F8EA7537CD5AF80D048497A432DE5907AEE52785D07061462FC511467BE720
    SPKI SHA256: 120A54EDBB14D3CBD2B33EBF67010220374AE6C4F881DEA68937BF8BFF7174AD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/rootclientauthcag1.crt
- CRL Distribution Points: http://crl.emsign.com/?rootclientauthcag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Client Auth CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Client Auth CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G3
- Serial: C9301C02A5BE73A6EEB7E3554D1774
- SHA-256: 2997C32BEFC8DFBFC15981154443E63D5C06620AD408EE41082BA0669C064CFA
- SPKI SHA-256: 89892E3C0B86EBB28B61BB198C593B73A91B27A6D8E024F20CABF983AAA97E1A
- Validity: 2024-07-11 to 2039-07-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignClientAuthCAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?rootclientauthcag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c9:30:1c:02:a5:be:73:a6:ee:b7:e3:55:4d:17:74
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G3
        Validity
            Not Before: Jul 11 16:49:41 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Client Auth CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                49:F5:CF:F7:0D:58:CF:9E:81:71:78:8A:AC:39:3E:93:C6:3E:E6:F2
            X509v3 Subject Key Identifier:
                B2:72:AA:A4:22:36:73:1B:FD:CF:79:A9:73:E3:78:74:B5:CF:74:BD
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/rootclientauthcag3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootclientauthcag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 2997C32BEFC8DFBFC15981154443E63D5C06620AD408EE41082BA0669C064CFA
    SPKI SHA256: 89892E3C0B86EBB28B61BB198C593B73A91B27A6D8E024F20CABF983AAA97E1A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/rootclientauthcag3.crt
- CRL Distribution Points: http://crl.emsign.com/?rootclientauthcag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign CS CA - C2

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign CS CA - C2
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C2
- Serial: B4E6BA3BE4B674A36434
- SHA-256: B0E6BB9D6E7A94BC4A6B89D96743438D2C565DBB0A697ABB21457ACA22A13CE4
- SPKI SHA-256: 278AEA3B0066F410F0A74B6D341DE6E4EF0C805CB4D079D02C79A91A174B7837
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignCSCAC2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b4:e6:ba:3b:e4:b6:74:a3:64:34
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign CS CA - C2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B3:F7:8A:A4:D6:0F:88:00:59:E8:51:17:4F:D5:7E:EC:86:22:81:9D
            X509v3 Subject Key Identifier:
                9A:42:64:A2:E0:62:94:95:C8:12:C3:0F:D5:7E:46:7C:41:2A:B2:2A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC2.crl
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B0E6BB9D6E7A94BC4A6B89D96743438D2C565DBB0A697ABB21457ACA22A13CE4
    SPKI SHA256: 278AEA3B0066F410F0A74B6D341DE6E4EF0C805CB4D079D02C79A91A174B7837
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign CS CA - G2

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign CS CA - G2
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Serial: 34591FC67FCBA9A537D7B16E71CB45
- SHA-256: C58E88B283F4C11B08FDBEF396C6242F50C51F4E2190F40751FD6983E9EFA8E2
- SPKI SHA-256: 38FC3D6E2FB7C591C4C11C5BB1F9F46913BE7F1C4ACFEB7643F28FEA39BEA6DF
- Validity: 2024-07-11 to 2039-07-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignCSCRCAG2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:59:1f:c6:7f:cb:a9:a5:37:d7:b1:6e:71:cb:45
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Validity
            Not Before: Jul 11 16:37:39 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign CS CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Subject Key Identifier:
                FC:FB:46:36:AE:B2:2E:1A:41:16:3F:8B:49:F1:DF:20:39:ED:77:0C
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/rootcscag2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C58E88B283F4C11B08FDBEF396C6242F50C51F4E2190F40751FD6983E9EFA8E2
    SPKI SHA256: 38FC3D6E2FB7C591C4C11C5BB1F9F46913BE7F1C4ACFEB7643F28FEA39BEA6DF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/rootcscag2.crt
- CRL Distribution Points: http://crl.emsign.com/?rootcscag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign CS CA - G2

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign CS CA - G2
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Serial: C084E666596139A1FA9B
- SHA-256: C2E4D1765005D5CA361D400A434B43036DBC931EC6D7B99C17BEC030CC74CA7D
- SPKI SHA-256: FA2E516C2BB85C813250BD791DA34D1F110E9C4A8C78A8BD834197D083637BC8
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignCSCAG2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c0:84:e6:66:59:61:39:a1:fa:9b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign CS CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                ED:EC:4D:45:61:18:28:E7:B3:23:28:11:1C:4D:A5:27:0D:5E:EC:F4
            X509v3 Subject Key Identifier:
                15:86:CA:B6:74:96:17:48:58:34:82:2C:CD:D2:E1:75:9E:AF:44:B7
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG2.crl
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C2E4D1765005D5CA361D400A434B43036DBC931EC6D7B99C17BEC030CC74CA7D
    SPKI SHA256: FA2E516C2BB85C813250BD791DA34D1F110E9C4A8C78A8BD834197D083637BC8
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign CS CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign CS CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Serial: 5BA07BE0A30F4BD2BFA51D85E7D9C8
- SHA-256: 945CAA768EF29EF4E89EC7EA1E9BF0AEDC1FF8F89B9AF8D1C76E70FFCD4E18AE
- SPKI SHA-256: 0F9DB7A54896C137102F9D992E4413E49716BBEEE02BB834D7E747562542E6B9
- Validity: 2024-07-11 to 2039-07-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignCSCAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:a0:7b:e0:a3:0f:4b:d2:bf:a5:1d:85:e7:d9:c8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Validity
            Not Before: Jul 11 16:55:28 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign CS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Subject Key Identifier:
                B3:36:EF:1B:B7:7D:89:F6:AA:17:3B:25:6E:0C:EA:49:32:15:C3:5C
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/rootcscag3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootcscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 945CAA768EF29EF4E89EC7EA1E9BF0AEDC1FF8F89B9AF8D1C76E70FFCD4E18AE
    SPKI SHA256: 0F9DB7A54896C137102F9D992E4413E49716BBEEE02BB834D7E747562542E6B9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/rootcscag3.crt
- CRL Distribution Points: http://crl.emsign.com/?rootcscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Device CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Device CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: B19BE3081E2D97B5BFCB
- SHA-256: D034B18751BEE10AAAF94C2F14350D3F654E5B934D0DDA592B31E58187A48952
- SPKI SHA-256: 5BB8639FF2309793B3489B01D68F912171142A136382AB3EF39720B4596210D3
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignDeviceCAC1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b1:9b:e3:08:1e:2d:97:b5:bf:cb
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Device CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                92:C5:7C:AD:63:20:E5:4C:23:CF:69:11:CF:A7:87:FB:81:F4:91:F8
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: D034B18751BEE10AAAF94C2F14350D3F654E5B934D0DDA592B31E58187A48952
    SPKI SHA256: 5BB8639FF2309793B3489B01D68F912171142A136382AB3EF39720B4596210D3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Device CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Device CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 0465835247364A904A8E
- SHA-256: 4C9198B673550858799AD2744CC083C1BA0027E77D3B8FD6D56CF53620D099E2
- SPKI SHA-256: 22FC3BC2FE57A5C91F74594EC63DFB4810F0888D16021929D56386137AF606F5
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignDeviceCAG1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:65:83:52:47:36:4a:90:4a:8e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Device CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                0B:93:78:E2:E0:35:07:6D:DF:86:77:8F:8C:51:8D:E3:35:7C:A9:77
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4C9198B673550858799AD2744CC083C1BA0027E77D3B8FD6D56CF53620D099E2
    SPKI SHA256: 22FC3BC2FE57A5C91F74594EC63DFB4810F0888D16021929D56386137AF606F5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Class 1 CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Class 1 CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: BD6A0796AB3F8955521E
- SHA-256: FAD2E98649F1C606150F55269EBC035AEA22FFAC131DE64BA6900C75D8447B7E
- SPKI SHA-256: 12A9538EF01C1F70E01E23134D0657940E390B2AF2FD972F99E1284669C49799
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCClass1CAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            bd:6a:07:96:ab:3f:89:55:52:1e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Class 1 CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                8C:D9:9F:A0:21:35:3E:FC:B4:3A:99:6C:2E:F2:0A:29:6F:F0:EC:92
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: FAD2E98649F1C606150F55269EBC035AEA22FFAC131DE64BA6900C75D8447B7E
    SPKI SHA256: 12A9538EF01C1F70E01E23134D0657940E390B2AF2FD972F99E1284669C49799
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Class 1 CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Class 1 CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: FB1E21982EB1B55C5925
- SHA-256: ABA6A65DCE8955BAF0685AB88809B7699C174496EF9EE991533251494F43CE10
- SPKI SHA-256: 562F740CA039A1E6E3FE76B9006FBC103D803B1A7F7B3C564EDBE24B5E23A50E
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCClass1CAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fb:1e:21:98:2e:b1:b5:5c:59:25
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Class 1 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                46:BE:80:C3:C8:27:FE:EC:9B:58:2B:1A:62:5D:B2:D5:D1:02:38:68
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: ABA6A65DCE8955BAF0685AB88809B7699C174496EF9EE991533251494F43CE10
    SPKI SHA256: 562F740CA039A1E6E3FE76B9006FBC103D803B1A7F7B3C564EDBE24B5E23A50E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Class 2 CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Class 2 CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: D1142766698BFCDEDA02
- SHA-256: DB4591F878F6672F5B70733A66AD7C9537B97E6F0AF5CA49AAB8ECB2CE02F86B
- SPKI SHA-256: EA7068B8A34041200A6CCCA7DB67C29C8DDDC312B47E24F852FCDC4E310C40AA
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCClass2CAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d1:14:27:66:69:8b:fc:de:da:02
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Class 2 CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                56:4C:89:B8:25:C8:98:EE:BD:F2:7C:62:2D:AE:69:39:3A:B6:17:2C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: DB4591F878F6672F5B70733A66AD7C9537B97E6F0AF5CA49AAB8ECB2CE02F86B
    SPKI SHA256: EA7068B8A34041200A6CCCA7DB67C29C8DDDC312B47E24F852FCDC4E310C40AA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Class 2 CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Class 2 CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 23E1BA02DFF3E900EDDD
- SHA-256: 4E9B731567177E1776A96D66D9120B3DEB28B800937EA4662565B3EF5EC8000B
- SPKI SHA-256: 7BA89C4D89EA3C07AA472895E93D59F9D78F8407E3656F516F3162FBF87CE344
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCClass2CAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:e1:ba:02:df:f3:e9:00:ed:dd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Class 2 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                E0:16:FE:BD:C4:E1:65:C6:A5:99:4C:89:5E:71:8E:D4:5D:67:F1:FD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 4E9B731567177E1776A96D66D9120B3DEB28B800937EA4662565B3EF5EC8000B
    SPKI SHA256: 7BA89C4D89EA3C07AA472895E93D59F9D78F8407E3656F516F3162FBF87CE344
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Class 3 CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Class 3 CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: 3D12A1CF78258D580854
- SHA-256: 5A9A03F2D3FE589BE63CDA11820A9F25F074C92034F51C047D34226D252EC025
- SPKI SHA-256: EF27C5E407461FBE59C7D92CB8219794694841C5E54DB3C554E87971C693174A
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCClass3CAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3d:12:a1:cf:78:25:8d:58:08:54
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Class 3 CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                F1:66:AB:96:8C:A4:0D:D2:26:62:33:2F:9A:55:09:5D:D9:E6:48:4A
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5A9A03F2D3FE589BE63CDA11820A9F25F074C92034F51C047D34226D252EC025
    SPKI SHA256: EF27C5E407461FBE59C7D92CB8219794694841C5E54DB3C554E87971C693174A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Class 3 CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Class 3 CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: B8EB258324DB08ACC2F5
- SHA-256: 7066A0F42F530E0DB5AFEE72A3B04DE614E7D2305C67D12C756BB215E37CB975
- SPKI SHA-256: 8C26973807C965211C676B2F287279353209A709D0898B27923FEB39238DE945
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCClass3CAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b8:eb:25:83:24:db:08:ac:c2:f5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Class 3 CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                22:62:4A:BC:7E:6D:A1:30:B7:2A:C9:95:7E:2A:23:DE:3D:27:F3:8D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7066A0F42F530E0DB5AFEE72A3B04DE614E7D2305C67D12C756BB215E37CB975
    SPKI SHA256: 8C26973807C965211C676B2F287279353209A709D0898B27923FEB39238DE945
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC CS CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC CS CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: B8973C4278609F2AF2A4
- SHA-256: A3AFD72375C1D7A8330E62D577E13581B72332C8062DFA9CF39E51AE65088582
- SPKI SHA-256: 421DE4F594192D7AB488FBD77BF4FFEB71F94D2FAB65E0FB77B4CC3D80769C34
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCCSCAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b8:97:3c:42:78:60:9f:2a:f2:a4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC CS CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                74:BF:90:17:0E:A3:70:6E:3C:53:C9:CC:01:51:2E:5B:A7:80:80:BB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A3AFD72375C1D7A8330E62D577E13581B72332C8062DFA9CF39E51AE65088582
    SPKI SHA256: 421DE4F594192D7AB488FBD77BF4FFEB71F94D2FAB65E0FB77B4CC3D80769C34
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC CS CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC CS CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 35CF922FB9008249F89C
- SHA-256: 0D6869A2B4F5DF77A6AFB034225E9BEF345743CF306EDF36EE35B9D05AFAD89C
- SPKI SHA-256: 0A11949B826E7D00A0C5F8D310B2D0D53F77F8402E03742B70A28550094A09DA
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCCSCAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:cf:92:2f:b9:00:82:49:f8:9c
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC CS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                E6:1A:AE:5A:79:8C:D0:28:4D:37:E0:9E:6B:C5:2D:5D:B4:6C:F8:EB
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0D6869A2B4F5DF77A6AFB034225E9BEF345743CF306EDF36EE35B9D05AFAD89C
    SPKI SHA256: 0A11949B826E7D00A0C5F8D310B2D0D53F77F8402E03742B70A28550094A09DA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Device CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Device CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: D9365F15842A1D0689C3
- SHA-256: 3D4511D0A80AA949A6D99B253A173471797C4459187A6329E736C37CB5493E46
- SPKI SHA-256: 6E915EF2D8286944381A50006B47D45665642C42803B5AECF7110BB3C9DD5671
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCDeviceCAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d9:36:5f:15:84:2a:1d:06:89:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Device CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                04:F6:54:AF:2E:B4:DD:A7:44:1E:CA:F0:63:9C:24:15:43:58:2F:CF
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3D4511D0A80AA949A6D99B253A173471797C4459187A6329E736C37CB5493E46
    SPKI SHA256: 6E915EF2D8286944381A50006B47D45665642C42803B5AECF7110BB3C9DD5671
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Device CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Device CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 876282A8FD758C391EC3
- SHA-256: 70B9BA595412CF8614B76747FD683CCA2759F42642164834FBEFDD88505C4F1C
- SPKI SHA-256: C844C56A21F48EAC0437ECB3BBAA476ED9A3804E57CD3DDDBE68BF5B36F7D613
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCDeviceCAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            87:62:82:a8:fd:75:8c:39:1e:c3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Device CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                A5:AC:F9:1F:5A:25:8E:10:B0:29:DA:19:00:26:86:E8:A1:E6:E8:D9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 70B9BA595412CF8614B76747FD683CCA2759F42642164834FBEFDD88505C4F1C
    SPKI SHA256: C844C56A21F48EAC0437ECB3BBAA476ED9A3804E57CD3DDDBE68BF5B36F7D613
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: -
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.


- [historical] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC EV CS CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC EV CS CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: 6004C5E20B62FDD48C46
- SHA-256: CB210979924020970337AE32DA5C3F981A9E05714EC22BB1C3421FE695E5157A
- SPKI SHA-256: 15376F44B0B1857BF376A7326727AD61EE0D69E0FFC21868DA978C067BF2DFFD
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCEVCSCAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            60:04:c5:e2:0b:62:fd:d4:8c:46
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC EV CS CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                A7:6A:A4:7D:5D:0E:18:02:D1:3E:EE:04:D6:DF:21:C7:3A:23:61:9C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: CB210979924020970337AE32DA5C3F981A9E05714EC22BB1C3421FE695E5157A
    SPKI SHA256: 15376F44B0B1857BF376A7326727AD61EE0D69E0FFC21868DA978C067BF2DFFD
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC EV CS CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC EV CS CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 23BA23AB486AE7D5C0FE
- SHA-256: 0BADA979B71402FE860696032CF40E9D2A3F41CCB5D03BE33FBB94A80D7FFC7C
- SPKI SHA-256: 10999CC87382EE51772DE4F6B40E8D11E880ADA388780F52D54629B74DB191F3
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCEVCSCAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            23:ba:23:ab:48:6a:e7:d5:c0:fe
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC EV CS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                FA:5C:F7:B7:49:4D:5D:6B:F0:32:28:E1:E5:D5:AD:FA:FA:D5:BC:83
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0BADA979B71402FE860696032CF40E9D2A3F41CCB5D03BE33FBB94A80D7FFC7C
    SPKI SHA256: 10999CC87382EE51772DE4F6B40E8D11E880ADA388780F52D54629B74DB191F3
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC EV SSL CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC EV SSL CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: 1B50581F7334B30B2723
- SHA-256: C0A578F2109E6F42D3D939948DEEAB729B20F7B23B4237ABD8494DF554CF985C
- SPKI SHA-256: 5046252D54982AEBF99D11AA0319E02B53FA8E9CB2DE8C8B6469C5A5020F4059
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCEVSSLCAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            1b:50:58:1f:73:34:b3:0b:27:23
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC EV SSL CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                48:B7:68:E8:3C:B2:E6:B1:12:44:4C:C4:D7:D3:9A:0B:6F:E9:5A:C6
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C0A578F2109E6F42D3D939948DEEAB729B20F7B23B4237ABD8494DF554CF985C
    SPKI SHA256: 5046252D54982AEBF99D11AA0319E02B53FA8E9CB2DE8C8B6469C5A5020F4059
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC EV SSL CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC EV SSL CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 01FE3E6C68DEBBEC263E
- SHA-256: 0116F17F97CDEF4ADE2E63CF2C1B064FD99F404D2B914100BC241F0781853323
- SPKI SHA-256: 7F4D74D75A846857FA5AAAB7C322500AEF7A3F5A7821AE1F606F55FFB43A3EEE
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCEVSSLCAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:fe:3e:6c:68:de:bb:ec:26:3e
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC EV SSL CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                D1:AA:B4:D2:D2:25:82:4E:B3:F0:93:60:17:4A:9B:63:7A:F9:1F:0D
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 0116F17F97CDEF4ADE2E63CF2C1B064FD99F404D2B914100BC241F0781853323
    SPKI SHA256: 7F4D74D75A846857FA5AAAB7C322500AEF7A3F5A7821AE1F606F55FFB43A3EEE
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC SMIME CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign ECC SMIME CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 0E906BB2267EC0FF
- SHA-256: F5B3E914CDE2954F65464FA8E9D69F0492622B3C2AC243987B11CBBF1B451307
- SPKI SHA-256: 56EF977F0F2900D02301D37F103FE78459AA528EF1EAE52E738F5A384E33BC46
- Validity: 2023-08-23 to 2038-08-22
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com/?emSignECCSMIMECAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1049457126071517439 (0xe906bb2267ec0ff)
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Aug 23 07:50:56 2023 GMT
            Not After : Aug 22 07:50:56 2038 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign ECC SMIME CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                A5:EC:41:FB:78:59:B5:B1:43:A0:67:19:B5:D7:AF:AA:88:EA:58:6C
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignECCRootCAG3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: F5B3E914CDE2954F65464FA8E9D69F0492622B3C2AC243987B11CBBF1B451307
    SPKI SHA256: 56EF977F0F2900D02301D37F103FE78459AA528EF1EAE52E738F5A384E33BC46
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignECCRootCAG3.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign ECC SSL CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC SSL CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: 5B7D9BB1FD33B9BC1D84
- SHA-256: A061D445399714C38FC101A6E9AFBDB381F112FA5DE7D5BC14904558D1ED3276
- SPKI SHA-256: 4CFCA6CECDA04930A74734FCDDDC694C7C5F1A5DAD750F6C9E109F5D771E8F2E
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCSSLCAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5b:7d:9b:b1:fd:33:b9:bc:1d:84
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC SSL CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                E3:E8:97:1E:BF:C4:3D:3A:B0:DC:F7:1D:9D:3F:5F:2C:B1:6D:EB:6C
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: A061D445399714C38FC101A6E9AFBDB381F112FA5DE7D5BC14904558D1ED3276
    SPKI SHA256: 4CFCA6CECDA04930A74734FCDDDC694C7C5F1A5DAD750F6C9E109F5D771E8F2E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC SSL CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC SSL CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 72DDC7E9DCE9B0DCFFC7
- SHA-256: 6B51D1DCF4EB7AEE424185CB1B9580574B39CB963863DE3EC1AD31DDB076CE9F
- SPKI SHA-256: F4ED3C5EA849E062B9AA318D1FD218DB85D0C611AFF1DB056DB64304F370D710
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCSSLCAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            72:dd:c7:e9:dc:e9:b0:dc:ff:c7
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC SSL CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                13:8D:4C:28:99:E1:62:B7:D2:E0:53:E3:18:D1:62:DC:1C:CA:66:FA
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 6B51D1DCF4EB7AEE424185CB1B9580574B39CB963863DE3EC1AD31DDB076CE9F
    SPKI SHA256: F4ED3C5EA849E062B9AA318D1FD218DB85D0C611AFF1DB056DB64304F370D710
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Time stamping CA - C3

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Time stamping CA - C3
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign ECC Root CA - C3
- Serial: B94B49C6436D72090201
- SHA-256: 71D2EE4DDA251D9244F7CE7C6D478EC552D424EF719F02B71030F2821B6BC853
- SPKI SHA-256: 75CAEA0C53B22717E992C8F3F423BF2127AB3FAC265FB558895F134FC53623C2
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCTSACAC3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b9:4b:49:c6:43:6d:72:09:02:01
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Root CA - C3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign ECC Time stamping CA - C3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:5A:48:D0:80:20:40:F2:A8:E9:00:07:69:19:77:A7:E6:C3:F4:CF
            X509v3 Subject Key Identifier:
                0B:BF:47:0B:3D:65:F5:4E:73:4C:1C:AD:1E:4E:67:52:09:2D:26:BD
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 71D2EE4DDA251D9244F7CE7C6D478EC552D424EF719F02B71030F2821B6BC853
    SPKI SHA256: 75CAEA0C53B22717E992C8F3F423BF2127AB3FAC265FB558895F134FC53623C2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign ECC Time stamping CA - G3

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Time stamping CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 84A863D6F61818464D34
- SHA-256: C422AB86C1729E889FBCAF5CD73F217E03C29FE2AC50212F451307D915869F47
- SPKI SHA-256: 628389A5306D2FF30DE784A4B4B8ABBDCD1272EB0E0A6ECD6D2476F6ED53702A
- Validity: 2018-02-18 to 2033-02-18
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignECCTSACAG3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:a8:63:d6:f6:18:18:46:4d:34
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Time stamping CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                F1:DD:23:B0:F4:F1:1D:EB:24:35:64:63:3C:10:A9:D9:54:8F:08:3F
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: C422AB86C1729E889FBCAF5CD73F217E03C29FE2AC50212F451307D915869F47
    SPKI SHA256: 628389A5306D2FF30DE784A4B4B8ABBDCD1272EB0E0A6ECD6D2476F6ED53702A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign EV CS CA - C2

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign EV CS CA - C2
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C2
- Serial: AE0882F16DBA80375653
- SHA-256: 024998101210644F68FAE9115543A5E6D26A6DB0D2C10366FF2D5BB505D8872D
- SPKI SHA-256: 0FA07B240A5441B610CCA2789D747DCDCFE3A396D6E7BDA6496B6F91EFA90E0A
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignEVCSCAC2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ae:08:82:f1:6d:ba:80:37:56:53
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign EV CS CA - C2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B3:F7:8A:A4:D6:0F:88:00:59:E8:51:17:4F:D5:7E:EC:86:22:81:9D
            X509v3 Subject Key Identifier:
                5B:9F:D5:1A:1D:04:3E:61:B6:65:17:B8:B0:E9:F5:85:F5:48:2D:17
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC2.crl
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 024998101210644F68FAE9115543A5E6D26A6DB0D2C10366FF2D5BB505D8872D
    SPKI SHA256: 0FA07B240A5441B610CCA2789D747DCDCFE3A396D6E7BDA6496B6F91EFA90E0A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign EV CS CA - G2

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign EV CS CA - G2
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Serial: 3CA9F3D18C08E50959D5
- SHA-256: 69E2448C5F03EEDE5EC2C907EFE96C3D33AD679B49CD29C38C5182323121BEFF
- SPKI SHA-256: F9990A4EA082FA7FF79287D3C190D850EE903A3B1EA91D5EBB5651FCDAF93D14
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignEVCSCAG2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3c:a9:f3:d1:8c:08:e5:09:59:d5
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign EV CS CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                ED:EC:4D:45:61:18:28:E7:B3:23:28:11:1C:4D:A5:27:0D:5E:EC:F4
            X509v3 Subject Key Identifier:
                47:95:C9:61:C0:B0:6A:44:10:2F:1A:35:DA:58:B0:96:AA:F6:4B:8E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG2.crl
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 69E2448C5F03EEDE5EC2C907EFE96C3D33AD679B49CD29C38C5182323121BEFF
    SPKI SHA256: F9990A4EA082FA7FF79287D3C190D850EE903A3B1EA91D5EBB5651FCDAF93D14
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign EV SSL CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign EV SSL CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: BADFD29B3F1E678C6960
- SHA-256: F6F159286A1401DE5397E21A0090534A85F5E7B9F98FD4A5A47B1DFFD4BFDED4
- SPKI SHA-256: 6C9A5A1AF4FE131A108B6FDA9F51C6DCCA39C8CAE8B74D8E47217F352E69E49F
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignEVSSLCAC1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ba:df:d2:9b:3f:1e:67:8c:69:60
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign EV SSL CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                C9:71:16:45:43:3B:16:5E:5F:46:FD:EE:35:4D:44:7B:7D:AE:75:07
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F6F159286A1401DE5397E21A0090534A85F5E7B9F98FD4A5A47B1DFFD4BFDED4
    SPKI SHA256: 6C9A5A1AF4FE131A108B6FDA9F51C6DCCA39C8CAE8B74D8E47217F352E69E49F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign EV SSL CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign EV SSL CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 626CB92B237FF82E3F50
- SHA-256: 4334EEB2CC114F82BEE6F8A7E5AEA03A42EB2E1F70CBD66102E414D72F0033B9
- SPKI SHA-256: BB2B9B953E92B17DE687FDC420EDBF4EFE5FB5170BE34C02CC9D06F6B3A360A1
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignEVSSLCAG1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            62:6c:b9:2b:23:7f:f8:2e:3f:50
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign EV SSL CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                B2:9D:CF:41:A7:E9:C3:E0:85:56:40:98:4B:F6:8F:7C:55:29:E7:7E
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4334EEB2CC114F82BEE6F8A7E5AEA03A42EB2E1F70CBD66102E414D72F0033B9
    SPKI SHA256: BB2B9B953E92B17DE687FDC420EDBF4EFE5FB5170BE34C02CC9D06F6B3A360A1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Root Client Auth CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 8B0DCB4D9A00ECC11B0677FC86BCC8
- SHA-256: 6FB75190477405C28AFFFE25338A92F4973956ED5B1A2353B24B6204E04D4CF9
- SPKI SHA-256: B5EE1C904AC2AAE39C92601AB466269C0C1CD0B96BADBD251B0ED88E6C4DED68
- Validity: 2024-07-11 to 2039-07-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?rootclientauthcag1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            8b:0d:cb:4d:9a:00:ec:c1:1b:06:77:fc:86:bc:c8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Jul 11 15:21:32 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                DB:57:7B:CE:B1:85:DE:3A:4E:AF:C6:27:40:23:6F:55:11:14:45:24
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignRootCAG1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 6FB75190477405C28AFFFE25338A92F4973956ED5B1A2353B24B6204E04D4CF9
    SPKI SHA256: B5EE1C904AC2AAE39C92601AB466269C0C1CD0B96BADBD251B0ED88E6C4DED68
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignRootCAG1.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root Client Auth CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root Client Auth CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 50243F8B6EE1D97C789089421ED2FD
- SHA-256: 63088538028E233C61B54C5A4238B7C753C04F32362F1C95A428D28E9CB6B15E
- SPKI SHA-256: 8DD3D055A7F47FFBCA287285DCFD201DDE92823CCC484D30F11CC40F079B3A3E
- Validity: 2024-07-11 to 2039-07-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?rootclientauthcag3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            50:24:3f:8b:6e:e1:d9:7c:78:90:89:42:1e:d2:fd
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Jul 11 15:57:53 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root Client Auth CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                49:F5:CF:F7:0D:58:CF:9E:81:71:78:8A:AC:39:3E:93:C6:3E:E6:F2
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignECCRootCAG3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 63088538028E233C61B54C5A4238B7C753C04F32362F1C95A428D28E9CB6B15E
    SPKI SHA256: 8DD3D055A7F47FFBCA287285DCFD201DDE92823CCC484D30F11CC40F079B3A3E
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, Microsoft Smartcard Login, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignECCRootCAG3.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root CS CA - G2

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G2
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Serial: 5A1E22BDB4FAA8E679BD791F957537
- SHA-256: A455EB8D8DC03CC7189B6A9438300D66373EB3225252CED2B12A6D25F0F940E0
- SPKI SHA-256: 941EA0CBCE0926D9F34EC667CEE669B61FD39F4338FA0B91048D5749D8880D25
- Validity: 2024-07-11 to 2039-07-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?rootcscag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5a:1e:22:bd:b4:fa:a8:e6:79:bd:79:1f:95:75:37
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Validity
            Not Before: Jul 11 15:38:19 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                ED:EC:4D:45:61:18:28:E7:B3:23:28:11:1C:4D:A5:27:0D:5E:EC:F4
            X509v3 Subject Key Identifier:
                E6:1C:C6:AA:27:B4:8B:F2:BD:85:64:5F:AF:F4:BA:72:A6:D0:01:75
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignRootCAG2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A455EB8D8DC03CC7189B6A9438300D66373EB3225252CED2B12A6D25F0F940E0
    SPKI SHA256: 941EA0CBCE0926D9F34EC667CEE669B61FD39F4338FA0B91048D5749D8880D25
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignRootCAG2.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root CS CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root CS CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 14C6754E93E5D94C638D3FC90FAD76
- SHA-256: 7137FA71AD46BA686F746D1014AC57E8E6C6E9AF4AA2F73C0C44A5CF27DEBB59
- SPKI SHA-256: 0A6C2B2CA5B364207954171987AC9D2178561569D8205457E77CA90C32EDE282
- Validity: 2024-07-11 to 2039-07-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?rootcscag3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            14:c6:75:4e:93:e5:d9:4c:63:8d:3f:c9:0f:ad:76
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Jul 11 16:10:30 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root CS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                68:74:03:F8:85:CA:8D:54:50:57:1D:16:E0:C8:DE:45:0D:AB:CD:2D
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignECCRootCAG3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7137FA71AD46BA686F746D1014AC57E8E6C6E9AF4AA2F73C0C44A5CF27DEBB59
    SPKI SHA256: 0A6C2B2CA5B364207954171987AC9D2178561569D8205457E77CA90C32EDE282
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: Code Signing
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignECCRootCAG3.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root SMIME CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 91685541577A36E8AE09ADEBE4CFAF
- SHA-256: A65160E9770D70D8ACE8EC3670A7B4EF1F87F4F507B1CE3D6FC623ADED0694C1
- SPKI SHA-256: 33836758BD871B8D464BD669B0B81832880B81E363FB8CBB21BA8E843A138858
- Validity: 2024-07-11 to 2039-07-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?rootsmimecag1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            91:68:55:41:57:7a:36:e8:ae:09:ad:eb:e4:cf:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Jul 11 15:15:05 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                75:6C:0C:20:36:DB:1C:88:D4:25:BE:B7:FA:69:D3:B1:8E:6C:A7:AB
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignRootCAG1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: A65160E9770D70D8ACE8EC3670A7B4EF1F87F4F507B1CE3D6FC623ADED0694C1
    SPKI SHA256: 33836758BD871B8D464BD669B0B81832880B81E363FB8CBB21BA8E843A138858
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignRootCAG1.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root SMIME CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: B33EBCAC96AC83A823E2786D76B6D8
- SHA-256: B4CEEBA48EF8CCC6090F6D2A62A85DBB51C5A106A7DC7EC5408270020F91C222
- SPKI SHA-256: 5DA77DC800F4C6FA93C6015AA6BD898FDB7C28D869E764571B25C00375A77755
- Validity: 2024-07-11 to 2039-07-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?rootsmimecag3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b3:3e:bc:ac:96:ac:83:a8:23:e2:78:6d:76:b6:d8
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Jul 11 15:50:28 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                BD:B1:C0:20:F9:33:0D:B3:A3:5A:7D:C5:BE:3B:31:60:1D:65:5C:0A
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignECCRootCAG3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: B4CEEBA48EF8CCC6090F6D2A62A85DBB51C5A106A7DC7EC5408270020F91C222
    SPKI SHA256: 5DA77DC800F4C6FA93C6015AA6BD898FDB7C28D869E764571B25C00375A77755
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignECCRootCAG3.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root TLS CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: F7AB65559E10812DF6484347586A25
- SHA-256: 9B913476EAB476E21E0887DBCDE44345D1359D28116B83B7CD3E87BD807EBF68
- SPKI SHA-256: ECE28E35289CE8621C72407949E5050052AD4607CC332EAF9B546029AACBFB7A
- Validity: 2024-07-11 to 2039-07-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?roottlscag1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            f7:ab:65:55:9e:10:81:2d:f6:48:43:47:58:6a:25
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Jul 11 14:52:21 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignRootCAG1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 9B913476EAB476E21E0887DBCDE44345D1359D28116B83B7CD3E87BD807EBF68
    SPKI SHA256: ECE28E35289CE8621C72407949E5050052AD4607CC332EAF9B546029AACBFB7A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignRootCAG1.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root TLS CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 961A3EFB1359576ED04005B4684A5B
- SHA-256: 3094025792039A68AF6E553686410BDAB7C0D4A36B9084CBA64202E35D6EBBDD
- SPKI SHA-256: C619E4780ED8E0ABEDA24AD732567DE4383A7EA941338F6D1A7D1B49AC792FE9
- Validity: 2024-07-11 to 2039-07-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?roottlscag3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            96:1a:3e:fb:13:59:57:6e:d0:40:05:b4:68:4a:5b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Jul 11 15:43:36 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignECCRootCAG3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3094025792039A68AF6E553686410BDAB7C0D4A36B9084CBA64202E35D6EBBDD
    SPKI SHA256: C619E4780ED8E0ABEDA24AD732567DE4383A7EA941338F6D1A7D1B49AC792FE9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignECCRootCAG3.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root TSA CA - G2

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G2
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Serial: 91DB8F1E6828435FBB765A369E54F9
- SHA-256: 2C15C5E31F6C837DC26D90568B10DE51D849E56E90ED25312507D2E108C31239
- SPKI SHA-256: 1CBBD4CB5EEC6A287E34636C07C78378FA3EB3C6D3FB0563286870F283D87034
- Validity: 2024-07-11 to 2039-07-09
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?roottsacag2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            91:db:8f:1e:68:28:43:5f:bb:76:5a:36:9e:54:f9
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Validity
            Not Before: Jul 11 15:31:56 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                ED:EC:4D:45:61:18:28:E7:B3:23:28:11:1C:4D:A5:27:0D:5E:EC:F4
            X509v3 Subject Key Identifier:
                FA:22:B0:1A:0E:0F:07:13:23:7A:38:FC:D0:37:31:36:88:D8:38:25
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignRootCAG2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 2C15C5E31F6C837DC26D90568B10DE51D849E56E90ED25312507D2E108C31239
    SPKI SHA256: 1CBBD4CB5EEC6A287E34636C07C78378FA3EB3C6D3FB0563286870F283D87034
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignRootCAG2.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Root TSA CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G3
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign ECC Root CA - G3
- Serial: 7629AFFB27C4349E7218CE483DB54B
- SHA-256: 873BE6F9EF3057221928E840686E2D18211A2680AE07051148C11A29D41BA98F
- SPKI SHA-256: 11567F2AAF4325C4044880C6ED2B37F1CA2586D87059CF254934D97C4FEE89A5
- Validity: 2024-07-11 to 2039-07-09
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?roottsacag3.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 1
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            76:29:af:fb:27:c4:34:9e:72:18:ce:48:3d:b5:4b
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign ECC Root CA - G3
        Validity
            Not Before: Jul 11 16:04:32 2024 GMT
            Not After : Jul  9 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                7C:5D:02:84:13:D4:CC:8A:9B:81:CE:17:1C:2E:29:1E:9C:48:63:42
            X509v3 Subject Key Identifier:
                40:C9:21:8A:78:42:45:B9:88:B1:EE:CA:C1:F6:68:F5:6A:09:33:B7
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignECCRootCAG3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 873BE6F9EF3057221928E840686E2D18211A2680AE07051148C11A29D41BA98F
    SPKI SHA256: 11567F2AAF4325C4044880C6ED2B37F1CA2586D87059CF254934D97C4FEE89A5
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":1}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignECCRootCAG3.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- path_len
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign SMIME CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign SMIME CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: AB98D0B97A5D695A
- SHA-256: BA9E8A1FCC4154B094BE734035ECA7E54E9F5619D511B265750EEB982E2C6D06
- SPKI SHA-256: FA1EA72910C99105C9F46EA1FD31DDDADA844D1F5DAEFDD1723ABD73FDF934D1
- Validity: 2023-08-23 to 2038-08-22
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignSMIMECAG1.crl
- Revocation status: Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: true
- Currently valid: false
- Lint surface: historical
- Audit visibility reason: Certificate is revoked and/or expired

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ab:98:d0:b9:7a:5d:69:5a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Aug 23 07:45:02 2023 GMT
            Not After : Aug 22 07:45:02 2038 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign SMIME CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                B4:A6:28:F5:83:09:A8:DA:00:84:8C:65:9D:8A:A3:F1:F9:10:40:04
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/emSignRootCAG1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: BA9E8A1FCC4154B094BE734035ECA7E54E9F5619D511B265750EEB982E2C6D06
    SPKI SHA256: FA1EA72910C99105C9F46EA1FD31DDDADA844D1F5DAEFDD1723ABD73FDF934D1
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/emSignRootCAG1.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

#### Historical zlint Findings

This certificate is revoked and/or expired. Findings are retained for historical/profile review and are not treated as current active audit issues.

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign SMIME CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign SMIME CA - G1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G1
- Serial: FE04E642637D4020947D6C5F4E0BD0
- SHA-256: B9E2588E93B5E53617B842E6ED34854EE46BA3D6721EC45DC650CE4439F514BE
- SPKI SHA-256: C7BC3A6DC167D21D8664DD741E6CEFD1F5493C00FFB6B9F7DF06A02360D67718
- Validity: 2024-07-11 to 2039-07-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignSMIMECRCAG1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?rootsmimecag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            fe:04:e6:42:63:7d:40:20:94:7d:6c:5f:4e:0b:d0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G1
        Validity
            Not Before: Jul 11 16:25:49 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign SMIME CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                75:6C:0C:20:36:DB:1C:88:D4:25:BE:B7:FA:69:D3:B1:8E:6C:A7:AB
            X509v3 Subject Key Identifier:
                83:24:E3:99:A1:97:28:23:95:62:01:50:4C:97:C6:7C:EB:EF:05:3E
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/rootsmimecag1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootsmimecag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: B9E2588E93B5E53617B842E6ED34854EE46BA3D6721EC45DC650CE4439F514BE
    SPKI SHA256: C7BC3A6DC167D21D8664DD741E6CEFD1F5493C00FFB6B9F7DF06A02360D67718
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/rootsmimecag1.crt
- CRL Distribution Points: http://crl.emsign.com/?rootsmimecag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign SMIME CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign SMIME CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root SMIME CA - G3
- Serial: 13BCE369D10F5CA4408D91B84155CB
- SHA-256: 30444F40CAC26FFF497B1CD00DDF4D81453A8A176272CC34ABE35FD564602B1B
- SPKI SHA-256: 73999087C5A025748F16413BA63CAA9D4082DD949242CC2A68D2854917FDD573
- Validity: 2024-07-11 to 2039-07-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignSMIMECAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?rootsmimecag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:bc:e3:69:d1:0f:5c:a4:40:8d:91:b8:41:55:cb
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root SMIME CA - G3
        Validity
            Not Before: Jul 11 16:46:31 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign SMIME CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                BD:B1:C0:20:F9:33:0D:B3:A3:5A:7D:C5:BE:3B:31:60:1D:65:5C:0A
            X509v3 Subject Key Identifier:
                3D:6D:1E:14:AD:5E:29:38:DB:0E:0F:B1:B4:0C:44:D8:1B:05:2B:88
            X509v3 Extended Key Usage:
                E-mail Protection, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/rootsmimecag3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?rootsmimecag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 30444F40CAC26FFF497B1CD00DDF4D81453A8A176272CC34ABE35FD564602B1B
    SPKI SHA256: 73999087C5A025748F16413BA63CAA9D4082DD949242CC2A68D2854917FDD573
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: E-mail Protection, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/rootsmimecag3.crt
- CRL Distribution Points: http://crl.emsign.com/?rootsmimecag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign SSL CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign SSL CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: 86766B7F96DF60C46F8B
- SHA-256: F91AACA0E4E533747A0880BFCF6F26720DC1D05494C3938DA6802290D5A09B32
- SPKI SHA-256: 56EF2B0A6EB61A13E93D422C90010E946FB1FD6244CDCE3A36A52B59F7F04D5A
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignSSLCAC1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            86:76:6b:7f:96:df:60:c4:6f:8b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign SSL CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                FC:C5:15:40:F1:AF:4F:13:B2:98:F2:71:0E:63:15:37:D1:94:6B:74
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: F91AACA0E4E533747A0880BFCF6F26720DC1D05494C3938DA6802290D5A09B32
    SPKI SHA256: 56EF2B0A6EB61A13E93D422C90010E946FB1FD6244CDCE3A36A52B59F7F04D5A
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign SSL CA - G1

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign SSL CA - G1
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G1
- Serial: 217AD58B1C713C002091
- SHA-256: 47B2EFBC3670E7DB4B41F22C51FC02EE84FB2DBF3082A49F2C2688122E9210A1
- SPKI SHA-256: AAFCCD83AF8F4BB25B08547E14BF9E01F1593A237AA575EC1F5B5CF5AB87945F
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignSSLCAG1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            21:7a:d5:8b:1c:71:3c:00:20:91
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G1
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign SSL CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
            X509v3 Subject Key Identifier:
                34:D1:F7:39:32:45:40:4A:99:2B:7D:89:6A:57:69:AD:95:AF:E3:37
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 47B2EFBC3670E7DB4B41F22C51FC02EE84FB2DBF3082A49F2C2688122E9210A1
    SPKI SHA256: AAFCCD83AF8F4BB25B08547E14BF9E01F1593A237AA575EC1F5B5CF5AB87945F
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] warn w_sub_ca_aia_does_not_contain_issuing_ca_url: 

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Time Stamping CA - C1

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Time Stamping CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: D6CB155EA221A1C4E37A
- SHA-256: 4D15E5199D88EAB1838E06EBA08BC690E971B4B1FCD77A6530E9C06F17FDF477
- SPKI SHA-256: AD446951A423D46EBDB77B1A60F09980C5D4D80B27E18BBFD5DA4346154C08A4
- Validity: 2020-08-12 to 2035-08-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emsigntsac1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Not Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            d6:cb:15:5e:a2:21:a1:c4:e3:7a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Aug 12 18:30:00 2020 GMT
            Not After : Aug 12 18:30:00 2035 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Time Stamping CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                31:55:8F:60:94:A8:BC:00:61:6F:9A:4D:E4:21:49:35:CE:C2:6B:23
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/RootCAC1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: 4D15E5199D88EAB1838E06EBA08BC690E971B4B1FCD77A6530E9C06F17FDF477
    SPKI SHA256: AD446951A423D46EBDB77B1A60F09980C5D4D80B27E18BBFD5DA4346154C08A4
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/RootCAC1.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign Time Stamping CA - C2

- Subject: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Time Stamping CA - C2
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C2
- Serial: 63720D6AB070BF2A157D
- SHA-256: 571FC70654AB8C1AA3B4A261A3D505FAE10BC4558FA17C72849B6B98BC845CAE
- SPKI SHA-256: ED5CB9C88D0B11BF5DF5815E1222E13EEAAD26683316307CBEAB84B8673F7E65
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignTSACAC2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:72:0d:6a:b0:70:bf:2a:15:7d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Time Stamping CA - C2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                B3:F7:8A:A4:D6:0F:88:00:59:E8:51:17:4F:D5:7E:EC:86:22:81:9D
            X509v3 Subject Key Identifier:
                C1:41:93:9D:9D:EF:34:CC:72:FD:D8:40:A6:1E:D6:B7:2A:43:AA:E9
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC2.crl
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 571FC70654AB8C1AA3B4A261A3D505FAE10BC4558FA17C72849B6B98BC845CAE
    SPKI SHA256: ED5CB9C88D0B11BF5DF5815E1222E13EEAAD26683316307CBEAB84B8673F7E65
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAC2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign Time Stamping CA - G2

- Subject: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Time Stamping CA - G2
- Issuer: countryName=IN, organizationalUnitName=emSign PKI, organizationName=eMudhra Technologies Limited, commonName=emSign Root CA - G2
- Serial: BA9E35E51ECFAC6C4740
- SHA-256: C3BE06C6B0A92334423180E95EA1E683AAB9C3B7D0F5CB8A4F51FBC1006F3DC0
- SPKI SHA-256: 0CE39965F7E40AAB1DA0295834788F192DA49A0F216BE9248D9BDE82B3AD7A95
- Validity: 2018-02-18 to 2033-02-18
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignTSACAG2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ba:9e:35:e5:1e:cf:ac:6c:47:40
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Root CA - G2
        Validity
            Not Before: Feb 18 18:30:00 2018 GMT
            Not After : Feb 18 18:30:00 2033 GMT
        Subject: C = IN, OU = emSign PKI, O = eMudhra Technologies Limited, CN = emSign Time Stamping CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                ED:EC:4D:45:61:18:28:E7:B3:23:28:11:1C:4D:A5:27:0D:5E:EC:F4
            X509v3 Subject Key Identifier:
                C0:0F:C1:F7:CF:9E:26:FF:8B:71:4A:CB:EC:F6:09:9F:2E:FA:C4:A1
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAG2.crl
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: C3BE06C6B0A92334423180E95EA1E683AAB9C3B7D0F5CB8A4F51FBC1006F3DC0
    SPKI SHA256: 0CE39965F7E40AAB1DA0295834788F192DA49A0F216BE9248D9BDE82B3AD7A95
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: -
- CRL Distribution Points: http://crl.emsign.com?RootCAG2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp

### emSign TLS CA - G1

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TLS CA - G1
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 437E0DB6D4E846134D00AD35463A7D
- SHA-256: DE029E40F6BB851DA4B804C65121D8535084FDF6B3B47DDF7E94B4E46A6C3437
- SPKI SHA-256: 88BC14017868FFAC5C3036B570C80B3E2F13220B292F10353F1448A6CC49B78B
- Validity: 2024-07-11 to 2039-07-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignTLSCAG1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            43:7e:0d:b6:d4:e8:46:13:4d:00:ad:35:46:3a:7d
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Jul 11 16:15:44 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign TLS CA - G1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                55:60:5A:7B:0C:E1:9A:13:62:C3:85:95:9F:8D:98:5C:68:02:CC:71
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/roottlscag1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: DE029E40F6BB851DA4B804C65121D8535084FDF6B3B47DDF7E94B4E46A6C3437
    SPKI SHA256: 88BC14017868FFAC5C3036B570C80B3E2F13220B292F10353F1448A6CC49B78B
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/roottlscag1.crt
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign TLS CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TLS CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 3B6ECEC869F677EFF33445C0E3EDC5
- SHA-256: 04E6DEA261B8720E0525E9DA23282100352BDEBC119CFC3DBD812C3D68A2BCDD
- SPKI SHA-256: EEF5DE4A7457BCB5EF97D075CF337FC8209E4BC2473ECF681127EE7DA0194CFA
- Validity: 2024-07-11 to 2039-07-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignTLSCAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:6e:ce:c8:69:f6:77:ef:f3:34:45:c0:e3:ed:c5
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Jul 11 16:42:13 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign TLS CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                65:D4:B5:57:37:F5:44:58:61:0C:6C:2F:3D:75:55:EA:B0:2A:60:33
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/roottlscag3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 04E6DEA261B8720E0525E9DA23282100352BDEBC119CFC3DBD812C3D68A2BCDD
    SPKI SHA256: EEF5DE4A7457BCB5EF97D075CF337FC8209E4BC2473ECF681127EE7DA0194CFA
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication, TLS Web Client Authentication
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/roottlscag3.crt
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign TSA CA - G2

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TSA CA - G2
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G2
- Serial: 3B259DBA31D18278A0C4195558F2D0
- SHA-256: D4317853D206E7C3365ABC631DF8BB409514F2A41B01A4601E2F6737BCCB1457
- SPKI SHA-256: 73061185D2E093CD14796559EECAA57697C57718C4CEC4A62E3D3CAEE2A65BAF
- Validity: 2024-07-11 to 2039-07-08
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignTSACRCAG2.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?roottsacag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3b:25:9d:ba:31:d1:82:78:a0:c4:19:55:58:f2:d0
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G2
        Validity
            Not Before: Jul 11 16:33:22 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign TSA CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FA:22:B0:1A:0E:0F:07:13:23:7A:38:FC:D0:37:31:36:88:D8:38:25
            X509v3 Subject Key Identifier:
                53:F8:AD:EA:0B:8D:63:FB:69:59:3C:1D:BF:51:43:09:0F:15:17:70
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/roottsacag2.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottsacag2.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: D4317853D206E7C3365ABC631DF8BB409514F2A41B01A4601E2F6737BCCB1457
    SPKI SHA256: 73061185D2E093CD14796559EECAA57697C57718C4CEC4A62E3D3CAEE2A65BAF
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/roottsacag2.crt
- CRL Distribution Points: http://crl.emsign.com/?roottsacag2.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### emSign TSA CA - G3

- Subject: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign TSA CA - G3
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TSA CA - G3
- Serial: 5CED5EFC3929614083FF28B466830F
- SHA-256: 7D9E3951568A20EF05B4880FFFB41D2E61AAA7401A7E67C19A3B9C71503E5705
- SPKI SHA-256: BFD287EA8BBDA66B68B51F70AA34A0BD7105FD8EF4212460A49B6DD63884EEC2
- Validity: 2024-07-11 to 2039-07-08
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: true
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?emSignTSACAG3.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Not Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com/?roottsacag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5c:ed:5e:fc:39:29:61:40:83:ff:28:b4:66:83:0f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TSA CA - G3
        Validity
            Not Before: Jul 11 16:52:36 2024 GMT
            Not After : Jul  8 18:30:00 2039 GMT
        Subject: C = IN, O = eMudhra Technologies Limited, CN = emSign TSA CA - G3
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                40:C9:21:8A:78:42:45:B9:88:B1:EE:CA:C1:F6:68:F5:6A:09:33:B7
            X509v3 Subject Key Identifier:
                BB:5C:7F:64:31:0C:62:62:28:E0:C4:89:16:B6:26:2F:D8:43:30:34
            X509v3 Extended Key Usage:
                Time Stamping
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/roottsacag3.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottsacag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 7D9E3951568A20EF05B4880FFFB41D2E61AAA7401A7E67C19A3B9C71503E5705
    SPKI SHA256: BFD287EA8BBDA66B68B51F70AA34A0BD7105FD8EF4212460A49B6DD63884EEC2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: Time Stamping
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/roottsacag3.crt
- CRL Distribution Points: http://crl.emsign.com/?roottsacag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon Intermediate CA - DVG2C

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - DVG2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 4FE567B5B596FA438DC6D291B3CB43
- SHA-256: 830905812307DF14C3D9D71B9A5A83247940857DD20BF6D67F6493D2070DA649
- SPKI SHA-256: 9E466AC372ED264083E2DB3B3C6971BBBDFB79C67EAD2D9E2BD6EC6BFAFFDCFC
- Validity: 2026-04-08 to 2029-04-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonDVG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:e5:67:b5:b5:96:fa:43:8d:c6:d2:91:b3:cb:43
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr  8 19:44:46 2026 GMT
            Not After : Apr  7 19:44:46 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon Intermediate CA - DVG2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                B3:62:6D:7C:F1:32:83:56:9B:44:0D:DA:20:8C:F8:DC:91:53:5F:40
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonDVG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: 830905812307DF14C3D9D71B9A5A83247940857DD20BF6D67F6493D2070DA649
    SPKI SHA256: 9E466AC372ED264083E2DB3B3C6971BBBDFB79C67EAD2D9E2BD6EC6BFAFFDCFC
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonDVG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon Intermediate CA - DVG3C

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - DVG3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: CE966707D5D28A7AE8AB6F00631B4F
- SHA-256: 3460C02F0B4B06C2739CB0DE17B41062B94515D837652AEBFF77AE87E0930CFF
- SPKI SHA-256: 73F0C5BE28DC503CD970AD9C452348306D43A38E956979DC1F5A0BF8B039CF64
- Validity: 2026-04-08 to 2029-04-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonDVG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.1 CABF DV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ce:96:67:07:d5:d2:8a:7a:e8:ab:6f:00:63:1b:4f
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr  8 19:59:38 2026 GMT
            Not After : Apr  7 19:59:38 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon Intermediate CA - DVG3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                5B:D5:00:2C:75:E0:A2:DA:C0:28:5E:82:F2:8E:44:7E:01:88:8F:37
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.3.6.1.4.1.50977.1.2.100
                Policy: 2.23.140.1.2.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonDVG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 3460C02F0B4B06C2739CB0DE17B41062B94515D837652AEBFF77AE87E0930CFF
    SPKI SHA256: 73F0C5BE28DC503CD970AD9C452348306D43A38E956979DC1F5A0BF8B039CF64
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.100, 2.23.140.1.2.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonDVG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon Intermediate CA - EVG2C

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - EVG2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 0E9098B1015D2FDA128A5342BDB088
- SHA-256: A83559D892F4692DA9A088A1B759773015D7AA6FB2B50B18C5F9F89CC27631E1
- SPKI SHA-256: A4B821003296CD5083060ADC331F74FBA8372997B0DD75AC75B4CD3838C6C626
- Validity: 2026-04-08 to 2029-04-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonEVG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:90:98:b1:01:5d:2f:da:12:8a:53:42:bd:b0:88
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr  8 19:54:08 2026 GMT
            Not After : Apr  7 19:54:08 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon Intermediate CA - EVG2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                D6:AD:18:10:6A:9B:55:9B:28:7D:81:BB:1B:96:F1:DF:7C:49:9C:9E
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonEVG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: A83559D892F4692DA9A088A1B759773015D7AA6FB2B50B18C5F9F89CC27631E1
    SPKI SHA256: A4B821003296CD5083060ADC331F74FBA8372997B0DD75AC75B4CD3838C6C626
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonEVG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon Intermediate CA - EVG3C

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - EVG3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: C61D1CF77FA6D4C88875A43BEB4AE4
- SHA-256: 5F2F050F9CDD928FE50102244733CBA7EA72204D9A7686949CE59E402AD1AAB9
- SPKI SHA-256: 6AA600DE06D8E834C2F1835A2766AD685D179B871B02D7BB6EC208680AD25397
- Validity: 2026-04-08 to 2029-04-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonEVG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.1 CABF EV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c6:1d:1c:f7:7f:a6:d4:c8:88:75:a4:3b:eb:4a:e4
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr  8 20:03:19 2026 GMT
            Not After : Apr  7 20:03:19 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon Intermediate CA - EVG3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                7D:C8:B6:61:09:20:42:94:C4:7F:A0:17:45:C6:3F:DD:9B:38:1B:BC
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.3.6.1.4.1.50977.1.2.120
                Policy: 2.23.140.1.1
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonEVG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 5F2F050F9CDD928FE50102244733CBA7EA72204D9A7686949CE59E402AD1AAB9
    SPKI SHA256: 6AA600DE06D8E834C2F1835A2766AD685D179B871B02D7BB6EC208680AD25397
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.120, 2.23.140.1.1
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonEVG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon Intermediate CA - OVG2C

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - OVG2C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 63A4D371C1A726EEBA6078D651F7DC
- SHA-256: BA02F2F97BA481D19ED4906BAB5602A9CE1CCE5D1F362EB5EC4F9D828EF09FFC
- SPKI SHA-256: 42EDDD4B85AC2C08029105B677F0ACA89261F77AD3425589BE3AA9AA030B0FEB
- Validity: 2026-04-08 to 2029-04-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonOVG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:a4:d3:71:c1:a7:26:ee:ba:60:78:d6:51:f7:dc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr  8 19:50:50 2026 GMT
            Not After : Apr  7 19:50:50 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon Intermediate CA - OVG2C
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                EC:93:D2:82:C2:96:F6:82:5B:2C:B4:FE:BB:CD:C0:D8:AC:6C:25:EE
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonOVG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: BA02F2F97BA481D19ED4906BAB5602A9CE1CCE5D1F362EB5EC4F9D828EF09FFC
    SPKI SHA256: 42EDDD4B85AC2C08029105B677F0ACA89261F77AD3425589BE3AA9AA030B0FEB
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonOVG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon Intermediate CA - OVG3C

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon Intermediate CA - OVG3C
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G3
- Serial: 66A11F396CE7BD4EFB9EB96208D6F3
- SHA-256: 566B3AF3CB6663A9F9E21EEF820889C2D1A4EA2F7DF0B7BB0D5060249870FA08
- SPKI SHA-256: E842A02A225A2377F842A6F0C245688CD8940BCC8CBF1E11A73C80F29889C3D2
- Validity: 2026-04-08 to 2029-04-07
- Key: EC 384 secp384r1
- Signature Algorithm: ecdsa-with-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-CA-TLS-CP-CPS-v1.06.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonOVG3C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            66:a1:1f:39:6c:e7:bd:4e:fb:9e:b9:62:08:d6:f3
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G3
        Validity
            Not Before: Apr  8 20:01:32 2026 GMT
            Not After : Apr  7 20:01:32 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon Intermediate CA - OVG3C
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                E1:3A:AB:21:7C:F1:E3:4D:54:AE:D4:72:B7:FD:8B:59:42:20:90:54
            X509v3 Subject Key Identifier:
                39:0B:B7:AA:1B:9A:DA:A6:1B:98:9C:A8:BC:87:44:99:6E:24:00:62
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonOVG3C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag3.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: ecdsa-with-SHA384
    SHA256 Fingerprint: 566B3AF3CB6663A9F9E21EEF820889C2D1A4EA2F7DF0B7BB0D5060249870FA08
    SPKI SHA256: E842A02A225A2377F842A6F0C245688CD8940BCC8CBF1E11A73C80F29889C3D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.1.2, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonOVG3C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag3.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings


- [current] error e_cabf_ecc_allowed_key_usages: DigitalSignature key usage is required for certificates with ECC public keys

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### InCommon RSA IGTF Server CA 4

- Subject: countryName=US, organizationName=Internet2, commonName=InCommon RSA IGTF Server CA 4
- Issuer: countryName=IN, organizationName=eMudhra Technologies Limited, commonName=emSign Root TLS CA - G1
- Serial: 40E8F6EEB511BF26B4FFAEE1F666FC
- SHA-256: F1A78E13D7AB31072E223918D257B541010AD93AE6D39F3D74A0D8B2EE4C3E7D
- SPKI SHA-256: E1BA9A97D89E75E299B49F95E907E42EF7232F6627DA976F79C2BD32AB0039F9
- Validity: 2026-04-08 to 2029-04-07
- Key: RSA 4096
- Signature Algorithm: RSA-SHA384

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: https://repository.emsign.com/cps/incommon/InCommon-IGTF-SSL-CPS-v3.02.md
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl-c.emsign.com/?EEEMIncommonIGTFOVG2C.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Trusted","chrome":"Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.4.3, 1.2.840.113612.5.2.2.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- anyPolicy: false
- CABF TLS policy OID: 2.23.140.1.2.2 CABF OV
- CPS qualifier: true
- AIA OCSP: http://ocsp-c.emsign.com
- CRL DP: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:e8:f6:ee:b5:11:bf:26:b4:ff:ae:e1:f6:66:fc
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = IN, O = eMudhra Technologies Limited, CN = emSign Root TLS CA - G1
        Validity
            Not Before: Apr  8 20:11:10 2026 GMT
            Not After : Apr  7 20:11:10 2029 GMT
        Subject: C = US, O = Internet2, CN = InCommon RSA IGTF Server CA 4
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                64:1D:C9:D8:F8:C4:EC:04:4B:22:81:F5:32:9A:5E:B9:E7:93:52:F9
            X509v3 Subject Key Identifier:
                88:52:E1:FB:E5:28:DE:A8:5F:DD:40:80:4B:3A:C5:A3:DA:52:22:0E
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.5923.1.4.3.4.3
                  CPS: https://incommon.org/certificates/repository
                Policy: 1.2.840.113612.5.2.2.1
                Policy: 1.3.6.1.4.1.50977.1.2.110
                Policy: 2.23.140.1.2.2
            Authority Information Access:
                OCSP - URI:http://ocsp-c.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonIGTFOVG2C.p7c
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com/?roottlscag1.crl
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
    Signature Algorithm: sha384WithRSAEncryption
    SHA256 Fingerprint: F1A78E13D7AB31072E223918D257B541010AD93AE6D39F3D74A0D8B2EE4C3E7D
    SPKI SHA256: E1BA9A97D89E75E299B49F95E907E42EF7232F6627DA976F79C2BD32AB0039F9
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Server Authentication
- Certificate Policies: 1.3.6.1.4.1.5923.1.4.3.4.3, 1.2.840.113612.5.2.2.1, 1.3.6.1.4.1.50977.1.2.110, 2.23.140.1.2.2
- AIA OCSP: http://ocsp-c.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/EMIncommonIGTFOVG2C.p7c
- CRL Distribution Points: http://crl.emsign.com/?roottlscag1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_server_auth_eku
- has_certificate_policies
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_cabf_tls_policy_oid
- cabf_tls_policy_oids
- has_crldp
- has_ocsp
- has_aia_ca_issuers

### Soft-Net Secure Signing CA - C1

- Subject: countryName=PE, organizationalUnitName=emSign PKI, organizationName=Soft and Net Solutions SAC, commonName=Soft-Net Secure Signing CA - C1
- Issuer: countryName=US, organizationalUnitName=emSign PKI, organizationName=eMudhra Inc, commonName=emSign Root CA - C1
- Serial: 4D3A149CFA144F9E3115
- SHA-256: CCEC157DA0F0BD58E3E8B584054FE0C44F04B4DD8C97B75B788D9140B05142F7
- SPKI SHA-256: F8004E61E811655974F86B81C3787FF52148AF9AD389F55A899CFC10B35C60D2
- Validity: 2020-08-12 to 2035-08-12
- Key: RSA 2048
- Signature Algorithm: RSA-SHA256

#### CCADB Disclosure Snapshot

- Subordinate CA Owner: -
- CP/CPS: -
- CP/CPS same as parent: false
- Audit URLs: -
- Audit same as parent: true
- CRLs issued by this CA disclosed in CCADB: http://crl.emsign.com?softnetsecuresignc1.crl
- Revocation status: Not Revoked
- Browser status: {"apple":"Not Trusted","chrome":"Not Trusted","microsoft":"Trusted","mozilla":"Trusted"}
- Certificate type: Intermediate Certificate

#### Lifecycle Snapshot

- Expired: false
- Revoked: false
- Currently valid: true
- Lint surface: current
- Audit visibility reason: -

#### Profile Snapshot

- CA: true
- pathLen: 0
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, Microsoft Smartcard Login
- Certificate Policies: 2.5.29.32.0
- anyPolicy: true
- CABF TLS policy OID: -
- CPS qualifier: true
- AIA OCSP: http://ocsp.emsign.com
- CRL DP: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### Parsed Certificate

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4d:3a:14:9c:fa:14:4f:9e:31:15
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, OU = emSign PKI, O = eMudhra Inc, CN = emSign Root CA - C1
        Validity
            Not Before: Aug 12 18:30:00 2020 GMT
            Not After : Aug 12 18:30:00 2035 GMT
        Subject: C = PE, OU = emSign PKI, O = Soft and Net Solutions SAC, CN = Soft-Net Secure Signing CA - C1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                FE:A1:E0:70:1E:2A:03:39:52:5A:42:BE:5C:91:85:7A:18:AA:4D:B5
            X509v3 Subject Key Identifier:
                E8:5E:02:12:E3:47:94:5B:65:5E:07:20:87:AD:B7:73:11:3D:6F:77
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Extended Key Usage:
                TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, Microsoft Smartcard Login
            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://repository.emsign.com
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            Authority Information Access:
                OCSP - URI:http://ocsp.emsign.com
                CA Issuers - URI:http://repository.emsign.com/certs/RootCAC1.crt
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.emsign.com?RootCAC1.crl
    Signature Algorithm: sha256WithRSAEncryption
    SHA256 Fingerprint: CCEC157DA0F0BD58E3E8B584054FE0C44F04B4DD8C97B75B788D9140B05142F7
    SPKI SHA256: F8004E61E811655974F86B81C3787FF52148AF9AD389F55A899CFC10B35C60D2
```

#### Extensions

- Basic Constraints: {"present":true,"critical":true,"ca":true,"path_len":0}
- Key Usage: keyCertSign, cRLSign
- EKU: TLS Web Client Authentication, E-mail Protection, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, Microsoft Smartcard Login
- Certificate Policies: 2.5.29.32.0
- AIA OCSP: http://ocsp.emsign.com
- AIA CA Issuers: http://repository.emsign.com/certs/RootCAC1.crt
- CRL Distribution Points: http://crl.emsign.com?RootCAC1.crl
- Name Constraints: {"present":false,"critical":false,"permitted":[],"excluded":[]}

#### zlint Findings

- available

#### Computed Flags

- is_subordinate_ca
- has_basic_constraints
- is_ca
- has_path_len_constraint
- has_key_usage
- has_eku
- has_client_auth_eku
- has_certificate_policies
- has_any_policy
- has_policy_qualifier
- has_cps_uri
- has_http_urls
- has_crldp
- has_ocsp
- has_aia_ca_issuers
