1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
3 * This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
7 #include "ExtendedValidation.h"
11 #include "mozilla/ArrayUtils.h"
12 #include "mozilla/Assertions.h"
13 #include "mozilla/Base64.h"
14 #include "mozilla/Casting.h"
15 #include "mozilla/PodOperations.h"
16 #include "nsDependentString.h"
19 #include "mozpkix/pkixtypes.h"
25 // See bug 1338873 about making these fields const.
26 const char* dottedOid
;
28 oidName
; // Set this to null to signal an invalid structure,
29 // (We can't have an empty list, so we'll use a dummy entry)
30 unsigned char sha256Fingerprint
[SHA256_LENGTH
];
31 const char* issuerBase64
;
32 const char* serialBase64
;
35 // HOWTO enable additional CA root certificates for EV:
37 // For each combination of "root certificate" and "policy OID",
38 // one entry must be added to the array named kEVInfos.
40 // We use the combination of "issuer name" and "serial number" to
41 // uniquely identify the certificate. In order to avoid problems
42 // because of encodings when comparing certificates, we don't
43 // use plain text representation, we rather use the original encoding
44 // as it can be found in the root certificate (in base64 format).
46 // We can use the NSS utility named "pp" to extract the encoding.
48 // Build standalone NSS including the NSS tools, then run
49 // pp -t certificate-identity -i the-cert-filename
51 // You will need the output from sections "Issuer", "Fingerprint (SHA-256)",
52 // "Issuer DER Base64" and "Serial DER Base64".
54 // The new section consists of the following components:
56 // - a comment that should contain the human readable issuer name
57 // of the certificate, as printed by the pp tool
58 // - the EV policy OID that is associated to the EV grant
59 // - a text description of the EV policy OID. The array can contain
60 // multiple entries with the same OID.
61 // Please make sure to use the identical OID text description for
62 // all entries with the same policy OID (use the text search
63 // feature of your text editor to find duplicates).
64 // When adding a new policy OID that is not yet contained in the array,
65 // please make sure that your new description is different from
66 // all the other descriptions (again use the text search feature
68 // - the SHA-256 fingerprint
69 // - the "Issuer DER Base64" as printed by the pp tool.
70 // Remove all whitespaces. If you use multiple lines, make sure that
71 // only the final line will be followed by a comma.
72 // - the "Serial DER Base64" (as printed by pp)
74 // After adding an entry, test it locally against the test site that
75 // has been provided by the CA. Note that you must use a version of NSS
76 // where the root certificate has already been added and marked as trusted
77 // for issuing SSL server certificates (at least).
79 // If you are able to connect to the site without certificate errors,
80 // but you don't see the EV status indicator, then most likely the CA
81 // has a problem in their infrastructure. The most common problems are
82 // related to the CA's OCSP infrastructure, either they use an incorrect
83 // OCSP signing certificate, or OCSP for the intermediate certificates
84 // isn't working, or OCSP isn't working at all.
87 static const size_t NUM_TEST_EV_ROOTS
= 2;
90 static const struct EVInfo kEVInfos
[] = {
92 // IMPORTANT! When extending this list, if you add another entry that uses
93 // the same dottedOid as an existing entry, use the same oidName.
95 // Debug EV certificates should all use the following OID:
96 // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
97 // (multiple entries with the same OID is ok)
98 // If you add or remove debug EV certs you must also modify NUM_TEST_EV_ROOTS
99 // so that the correct number of certs are skipped as these debug EV certs
100 // are NOT part of the default trust store.
102 // This is the PSM xpcshell testing EV certificate. It can be generated
103 // using pycert.py and the following specification:
109 // validity:20150101-20350101
110 // extension:basicConstraints:cA,
111 // extension:keyUsage:keyCertSign,cRLSign
113 // If this ever needs to change, re-generate the certificate and update the
114 // following entry with the new fingerprint, issuer, and serial number.
115 "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
116 "DEBUGtesting EV OID",
117 { 0x70, 0xED, 0xCB, 0x5A, 0xCE, 0x02, 0xC7, 0xC5, 0x0B, 0xA3, 0xD2, 0xD7,
118 0xC6, 0xF5, 0x0E, 0x18, 0x02, 0x19, 0x17, 0xF5, 0x48, 0x08, 0x9C, 0xB3,
119 0x8E, 0xEF, 0x9A, 0x1A, 0x4D, 0x7F, 0x82, 0x94 },
120 "MBExDzANBgNVBAMMBmV2cm9vdA==",
121 "IZSHsVgzcvhPgdfrgdMGlpSfMeg=",
124 // This is an RSA root with an inadequate key size. It is used to test that
125 // minimum key sizes are enforced when verifying for EV. It can be
126 // generated using pycert.py and the following specification:
128 // issuer:ev_root_rsa_2040
129 // subject:ev_root_rsa_2040
130 // issuerKey:evRSA2040
131 // subjectKey:evRSA2040
132 // validity:20150101-20350101
133 // extension:basicConstraints:cA,
134 // extension:keyUsage:cRLSign,keyCertSign
136 // If this ever needs to change, re-generate the certificate and update the
137 // following entry with the new fingerprint, issuer, and serial number.
138 "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
139 "DEBUGtesting EV OID",
140 { 0x40, 0xAB, 0x5D, 0xA5, 0x89, 0x15, 0xA9, 0x4B, 0x82, 0x87, 0xB8, 0xA6,
141 0x9A, 0x84, 0xB1, 0xDB, 0x7A, 0x9D, 0xDB, 0xB8, 0x4E, 0xE1, 0x23, 0xE3,
142 0xC6, 0x64, 0xE7, 0x50, 0xDC, 0x35, 0x8C, 0x68 },
143 "MBsxGTAXBgNVBAMMEGV2X3Jvb3RfcnNhXzIwNDA=",
144 "J7nCMgtzNcSPG7jAh3CWzlTGHQg=",
148 // CN=Cybertrust Global Root,O=Cybertrust, Inc
149 "1.3.6.1.4.1.6334.1.100.1",
151 { 0x96, 0x0A, 0xDF, 0x00, 0x63, 0xE9, 0x63, 0x56, 0x75, 0x0C, 0x29,
152 0x65, 0xDD, 0x0A, 0x08, 0x67, 0xDA, 0x0B, 0x9C, 0xBD, 0x6E, 0x77,
153 0x71, 0x4A, 0xEA, 0xFB, 0x23, 0x49, 0xAB, 0x39, 0x3D, 0xA3 },
154 "MDsxGDAWBgNVBAoTD0N5YmVydHJ1c3QsIEluYzEfMB0GA1UEAxMWQ3liZXJ0cnVz"
155 "dCBHbG9iYWwgUm9vdA==",
159 // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
160 "2.16.756.1.89.1.2.1.1",
162 { 0x62, 0xDD, 0x0B, 0xE9, 0xB9, 0xF5, 0x0A, 0x16, 0x3E, 0xA0, 0xF8,
163 0xE7, 0x5C, 0x05, 0x3B, 0x1E, 0xCA, 0x57, 0xEA, 0x55, 0xC8, 0x68,
164 0x8F, 0x64, 0x7C, 0x68, 0x81, 0xF2, 0xC8, 0x35, 0x7B, 0x95 },
165 "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
166 "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
170 // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
171 "2.16.840.1.114404.1.1.2.4.1",
173 { 0xCE, 0xCD, 0xDC, 0x90, 0x50, 0x99, 0xD8, 0xDA, 0xDF, 0xC5, 0xB1,
174 0xD2, 0x09, 0xB7, 0x37, 0xCB, 0xE2, 0xC1, 0x8C, 0xFB, 0x2C, 0x10,
175 0xC0, 0xFF, 0x0B, 0xCF, 0x0D, 0x32, 0x86, 0xFC, 0x1A, 0xA2 },
176 "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
177 "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
178 "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
179 "UJRs7Bjq1ZxN1ZfvdY+grQ==",
182 // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
183 "2.16.840.1.114404.1.1.2.4.1",
185 { 0xF1, 0xC1, 0xB5, 0x0A, 0xE5, 0xA2, 0x0D, 0xD8, 0x03, 0x0E, 0xC9,
186 0xF6, 0xBC, 0x24, 0x82, 0x3D, 0xD3, 0x67, 0xB5, 0x25, 0x57, 0x59,
187 0xB4, 0xE7, 0x1B, 0x61, 0xFC, 0xE9, 0xF7, 0x37, 0x5D, 0x73 },
188 "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
189 "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
190 "DPCOXAgWpa1Cf/DrJxhZ0A==",
193 // CN=Secure Global CA,O=SecureTrust Corporation,C=US
194 "2.16.840.1.114404.1.1.2.4.1",
196 { 0x42, 0x00, 0xF5, 0x04, 0x3A, 0xC8, 0x59, 0x0E, 0xBB, 0x52, 0x7D,
197 0x20, 0x9E, 0xD1, 0x50, 0x30, 0x29, 0xFB, 0xCB, 0xD4, 0x1C, 0xA1,
198 0xB5, 0x06, 0xEC, 0x27, 0xF1, 0x5A, 0xDE, 0x7D, 0xAC, 0x69 },
199 "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
200 "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
201 "B1YipOjUiolN9BPI8PjqpQ==",
204 // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
205 "1.3.6.1.4.1.6449.1.2.1.5.1",
207 { 0x17, 0x93, 0x92, 0x7A, 0x06, 0x14, 0x54, 0x97, 0x89, 0xAD, 0xCE,
208 0x2F, 0x8F, 0x34, 0xF7, 0xF0, 0xB6, 0x6D, 0x0F, 0x3A, 0xE3, 0xA3,
209 0xB8, 0x4D, 0x21, 0xEC, 0x15, 0xDB, 0xBA, 0x4F, 0xAD, 0xC7 },
210 "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
211 "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
212 "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
213 "H0evqmIAcFBUTAGem2OZKg==",
216 // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
217 "1.3.6.1.4.1.6449.1.2.1.5.1",
219 { 0x0C, 0x2C, 0xD6, 0x3D, 0xF7, 0x80, 0x6F, 0xA3, 0x99, 0xED, 0xE8,
220 0x09, 0x11, 0x6B, 0x57, 0x5B, 0xF8, 0x79, 0x89, 0xF0, 0x65, 0x18,
221 0xF9, 0x80, 0x8C, 0x86, 0x05, 0x03, 0x17, 0x8B, 0xAF, 0x66 },
222 "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
223 "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
224 "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
225 "ToEtioJl4AsC7j41AkblPQ==",
228 // CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
229 "1.3.6.1.4.1.6449.1.2.1.5.1",
231 { 0x68, 0x7F, 0xA4, 0x51, 0x38, 0x22, 0x78, 0xFF, 0xF0, 0xC8, 0xB1,
232 0x1F, 0x8D, 0x43, 0xD5, 0x76, 0x67, 0x1C, 0x6E, 0xB2, 0xBC, 0xEA,
233 0xB4, 0x13, 0xFB, 0x83, 0xD9, 0x65, 0xD0, 0x6D, 0x2F, 0xF2 },
234 "MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMd"
235 "QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0"
236 "IEV4dGVybmFsIENBIFJvb3Q=",
240 // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
241 "2.16.840.1.114413.1.7.23.3",
243 { 0xC3, 0x84, 0x6B, 0xF2, 0x4B, 0x9E, 0x93, 0xCA, 0x64, 0x27, 0x4C,
244 0x0E, 0xC6, 0x7C, 0x1E, 0xCC, 0x5E, 0x02, 0x4F, 0xFC, 0xAC, 0xD2,
245 0xD7, 0x40, 0x19, 0x35, 0x0E, 0x81, 0xFE, 0x54, 0x6A, 0xE4 },
246 "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
247 "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
252 // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
253 "2.16.840.1.114413.1.7.23.3",
255 { 0x45, 0x14, 0x0B, 0x32, 0x47, 0xEB, 0x9C, 0xC8, 0xC5, 0xB4, 0xF0,
256 0xD7, 0xB5, 0x30, 0x91, 0xF7, 0x32, 0x92, 0x08, 0x9E, 0x6E, 0x5A,
257 0x63, 0xE2, 0x74, 0x9D, 0xD3, 0xAC, 0xA9, 0x19, 0x8E, 0xDA },
258 "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
259 "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
260 "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
264 // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
265 "2.16.840.1.114414.1.7.23.3",
267 { 0x14, 0x65, 0xFA, 0x20, 0x53, 0x97, 0xB8, 0x76, 0xFA, 0xA6, 0xF0,
268 0xA9, 0x95, 0x8E, 0x55, 0x90, 0xE4, 0x0F, 0xCC, 0x7F, 0xAA, 0x4F,
269 0xB7, 0xC2, 0xC8, 0x67, 0x75, 0x21, 0xFB, 0x5F, 0xB6, 0x58 },
270 "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
271 "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
276 // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
277 "2.16.840.1.114414.1.7.23.3",
279 { 0x2C, 0xE1, 0xCB, 0x0B, 0xF9, 0xD2, 0xF9, 0xE1, 0x02, 0x99, 0x3F,
280 0xBE, 0x21, 0x51, 0x52, 0xC3, 0xB2, 0xDD, 0x0C, 0xAB, 0xDE, 0x1C,
281 0x68, 0xE5, 0x31, 0x9B, 0x83, 0x91, 0x54, 0xDB, 0xB7, 0xF5 },
282 "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
283 "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
284 "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
289 // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
290 "2.16.840.1.114412.2.1",
292 { 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
293 0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
294 0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
295 "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
296 "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
297 "bmNlIEVWIFJvb3QgQ0E=",
298 "AqxcJmoLQJuPC3nyrkYldw==",
301 // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
302 "1.3.6.1.4.1.8024.0.2.100.1.2",
304 { 0x85, 0xA0, 0xDD, 0x7D, 0xD7, 0x20, 0xAD, 0xB7, 0xFF, 0x05, 0xF8,
305 0x3D, 0x54, 0x2B, 0x20, 0x9D, 0xC7, 0xFF, 0x45, 0x28, 0xF7, 0xD6,
306 0x77, 0xB1, 0x83, 0x89, 0xFE, 0xA5, 0xE5, 0xC4, 0x9E, 0x86 },
307 "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
308 "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
312 // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
313 "1.3.6.1.4.1.782.1.2.1.8.1",
314 "Network Solutions EV OID",
315 { 0x15, 0xF0, 0xBA, 0x00, 0xA3, 0xAC, 0x7A, 0xF3, 0xAC, 0x88, 0x4C,
316 0x07, 0x2B, 0x10, 0x11, 0xA0, 0x77, 0xBD, 0x77, 0xC0, 0x97, 0xF4,
317 0x01, 0x64, 0xB2, 0xF8, 0x59, 0x8A, 0xBD, 0x83, 0x86, 0x0C },
318 "MGIxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhOZXR3b3JrIFNvbHV0aW9ucyBMLkwu"
319 "Qy4xMDAuBgNVBAMTJ05ldHdvcmsgU29sdXRpb25zIENlcnRpZmljYXRlIEF1dGhv"
321 "V8szb8JcFuZHFhfjkDFo4A==",
324 // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
325 "2.16.840.1.114028.10.1.2",
327 { 0x73, 0xC1, 0x76, 0x43, 0x4F, 0x1B, 0xC6, 0xD5, 0xAD, 0xF4, 0x5B,
328 0x0E, 0x76, 0xE7, 0x27, 0x28, 0x7C, 0x8D, 0xE5, 0x76, 0x16, 0xC1,
329 0xE6, 0xE6, 0x14, 0x1A, 0x2B, 0x2C, 0xBC, 0x7D, 0x8E, 0x4C },
330 "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
331 "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
332 "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
333 "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
337 // CN=Entrust Root Certification Authority - G4,OU="(c) 2015 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
338 "2.16.840.1.114028.10.1.2",
340 { 0xDB, 0x35, 0x17, 0xD1, 0xF6, 0x73, 0x2A, 0x2D, 0x5A, 0xB9, 0x7C,
341 0x53, 0x3E, 0xC7, 0x07, 0x79, 0xEE, 0x32, 0x70, 0xA6, 0x2F, 0xB4,
342 0xAC, 0x42, 0x38, 0x37, 0x24, 0x60, 0xE6, 0xF0, 0x1E, 0x88 },
343 "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
344 "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
345 "IDIwMTUgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
346 "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
348 "ANm1Q3+vqTkPAAAAAFVlrVg=",
351 // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
353 "CA/Browser Forum EV OID",
354 { 0xEB, 0xD4, 0x10, 0x40, 0xE4, 0xBB, 0x3E, 0xC7, 0x42, 0xC9, 0xE3,
355 0x81, 0xD3, 0x1E, 0xF2, 0xA4, 0x1A, 0x48, 0xB6, 0x68, 0x5C, 0x96,
356 0xE7, 0xCE, 0xF3, 0xC1, 0xDF, 0x6C, 0xD4, 0x33, 0x1C, 0x99 },
357 "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
358 "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
362 // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
364 "CA/Browser Forum EV OID",
365 { 0xCB, 0xB5, 0x22, 0xD7, 0xB7, 0xF1, 0x27, 0xAD, 0x6A, 0x01, 0x13,
366 0x86, 0x5B, 0xDF, 0x1C, 0xD4, 0x10, 0x2E, 0x7D, 0x07, 0x59, 0xAF,
367 0x63, 0x5A, 0x7C, 0xF4, 0x72, 0x0D, 0xC9, 0x63, 0xC5, 0x3B },
368 "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
369 "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
373 // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
374 "2.16.578.1.26.1.3.3",
376 { 0xED, 0xF7, 0xEB, 0xBC, 0xA2, 0x7A, 0x2A, 0x38, 0x4D, 0x38, 0x7B,
377 0x7D, 0x40, 0x10, 0xC6, 0x66, 0xE2, 0xED, 0xB4, 0x84, 0x3E, 0x4C,
378 0x29, 0xB4, 0xAE, 0x1D, 0x5B, 0x93, 0x32, 0xE6, 0xB2, 0x4D },
379 "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
380 "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
384 // CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
385 "1.3.6.1.4.1.17326.10.14.2.1.2",
386 "Camerfirma EV OID a",
387 { 0x06, 0x3E, 0x4A, 0xFA, 0xC4, 0x91, 0xDF, 0xD3, 0x32, 0xF3, 0x08,
388 0x9B, 0x85, 0x42, 0xE9, 0x46, 0x17, 0xD8, 0x93, 0xD7, 0xFE, 0x94,
389 0x4E, 0x10, 0xA7, 0x93, 0x7E, 0xE2, 0x9D, 0x96, 0x93, 0xC0 },
390 "MIGuMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
391 "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
392 "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMT"
393 "IENoYW1iZXJzIG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4",
397 // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
398 "1.3.6.1.4.1.34697.2.1",
399 "AffirmTrust EV OID a",
400 { 0x03, 0x76, 0xAB, 0x1D, 0x54, 0xC5, 0xF9, 0x80, 0x3C, 0xE4, 0xB2,
401 0xE2, 0x01, 0xA0, 0xEE, 0x7E, 0xEF, 0x7B, 0x57, 0xB6, 0x36, 0xE8,
402 0xA9, 0x3C, 0x9B, 0x8D, 0x48, 0x60, 0xC9, 0x6F, 0x5F, 0xA7 },
403 "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
404 "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
408 // CN=AffirmTrust Networking,O=AffirmTrust,C=US
409 "1.3.6.1.4.1.34697.2.2",
410 "AffirmTrust EV OID b",
411 { 0x0A, 0x81, 0xEC, 0x5A, 0x92, 0x97, 0x77, 0xF1, 0x45, 0x90, 0x4A,
412 0xF3, 0x8D, 0x5D, 0x50, 0x9F, 0x66, 0xB5, 0xE2, 0xC5, 0x8F, 0xCD,
413 0xB5, 0x31, 0x05, 0x8B, 0x0E, 0x17, 0xF3, 0xF0, 0xB4, 0x1B },
414 "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
415 "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
419 // CN=AffirmTrust Premium,O=AffirmTrust,C=US
420 "1.3.6.1.4.1.34697.2.3",
421 "AffirmTrust EV OID c",
422 { 0x70, 0xA7, 0x3F, 0x7F, 0x37, 0x6B, 0x60, 0x07, 0x42, 0x48, 0x90,
423 0x45, 0x34, 0xB1, 0x14, 0x82, 0xD5, 0xBF, 0x0E, 0x69, 0x8E, 0xCC,
424 0x49, 0x8D, 0xF5, 0x25, 0x77, 0xEB, 0xF2, 0xE9, 0x3B, 0x9A },
425 "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
426 "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
430 // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
431 "1.3.6.1.4.1.34697.2.4",
432 "AffirmTrust EV OID d",
433 { 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64,
434 0x7A, 0xDD, 0x25, 0x81, 0xB0, 0x7D, 0x79, 0xAD, 0xF8, 0x39, 0x7E,
435 0xB4, 0xEC, 0xBA, 0x9C, 0x5E, 0x84, 0x88, 0x82, 0x14, 0x23 },
436 "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
437 "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
441 // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
442 "1.2.616.1.113527.2.5.1.1",
444 { 0x5C, 0x58, 0x46, 0x8D, 0x55, 0xF5, 0x8E, 0x49, 0x7E, 0x74, 0x39,
445 0x82, 0xD2, 0xB5, 0x00, 0x10, 0xB6, 0xD1, 0x65, 0x37, 0x4A, 0xCF,
446 0x83, 0xA7, 0xD4, 0xA3, 0x2D, 0xB7, 0x68, 0xC4, 0x40, 0x8E },
447 "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
448 "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
449 "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
453 // CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
454 "1.2.616.1.113527.2.5.1.1",
456 { 0xB6, 0x76, 0xF2, 0xED, 0xDA, 0xE8, 0x77, 0x5C, 0xD3, 0x6C, 0xB0,
457 0xF6, 0x3C, 0xD1, 0xD4, 0x60, 0x39, 0x61, 0xF4, 0x9E, 0x62, 0x65,
458 0xBA, 0x01, 0x3A, 0x2F, 0x03, 0x07, 0xB6, 0xD0, 0xB8, 0x04 },
459 "MIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg"
460 "Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQw"
461 "IgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBIDI=",
462 "IdbQSk8lD8kyN/yqXhKN6Q==",
465 // CN=Izenpe.com,O=IZENPE S.A.,C=ES
466 "1.3.6.1.4.1.14777.6.1.1",
468 { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
469 0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
470 0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
471 "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
473 "ALC3WhZIX7/hy/WL1xnmfQ==",
476 // CN=Izenpe.com,O=IZENPE S.A.,C=ES
477 "1.3.6.1.4.1.14777.6.1.2",
479 { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
480 0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
481 0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
482 "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
484 "ALC3WhZIX7/hy/WL1xnmfQ==",
487 // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
488 "1.3.6.1.4.1.7879.13.24.1",
490 { 0xFD, 0x73, 0xDA, 0xD3, 0x1C, 0x64, 0x4F, 0xF1, 0xB4, 0x3B, 0xEF,
491 0x0C, 0xCD, 0xDA, 0x96, 0x71, 0x0B, 0x9C, 0xD9, 0x87, 0x5E, 0xCA,
492 0x7E, 0x31, 0x70, 0x7A, 0xF3, 0xE9, 0x6D, 0x52, 0x2B, 0xBD },
493 "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
494 "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
495 "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
499 // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
500 "1.3.6.1.4.1.40869.1.1.22.3",
502 { 0xBF, 0xD8, 0x8F, 0xE1, 0x10, 0x1C, 0x41, 0xAE, 0x3E, 0x80, 0x1B,
503 0xF8, 0xBE, 0x56, 0x35, 0x0E, 0xE9, 0xBA, 0xD1, 0xA6, 0xB9, 0xBD,
504 0x51, 0x5E, 0xDC, 0x5C, 0x6D, 0x5B, 0x87, 0x11, 0xAC, 0x44 },
505 "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
506 "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
511 // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
512 "1.3.6.1.4.1.4788.2.202.1",
514 { 0xEE, 0xC5, 0x49, 0x6B, 0x98, 0x8C, 0xE9, 0x86, 0x25, 0xB9, 0x34,
515 0x09, 0x2E, 0xEC, 0x29, 0x08, 0xBE, 0xD0, 0xB0, 0xF3, 0x16, 0xC2,
516 0xD4, 0x73, 0x0C, 0x84, 0xEA, 0xF1, 0xF3, 0xD3, 0x48, 0x81 },
517 "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
518 "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
522 // CN = Autoridad de Certificacion Firmaprofesional CIF A62634068, C = ES
523 "1.3.6.1.4.1.13177.10.1.3.10",
524 "Firmaprofesional EV OID",
525 { 0x04, 0x04, 0x80, 0x28, 0xBF, 0x1F, 0x28, 0x64, 0xD4, 0x8F, 0x9A,
526 0xD4, 0xD8, 0x32, 0x94, 0x36, 0x6A, 0x82, 0x88, 0x56, 0x55, 0x3F,
527 0x3B, 0x14, 0x30, 0x3F, 0x90, 0x14, 0x7F, 0x5D, 0x40, 0xEF },
528 "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
529 "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
533 // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
534 "1.3.6.1.4.1.40869.1.1.22.3",
536 { 0x59, 0x76, 0x90, 0x07, 0xF7, 0x68, 0x5D, 0x0F, 0xCD, 0x50, 0x87,
537 0x2F, 0x9F, 0x95, 0xD5, 0x75, 0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81,
538 0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
539 "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
540 "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
544 // CN = E-Tugra Certification Authority, OU = E-Tugra Sertifikasyon Merkezi, O = E-TuÄŸra EBG BiliÅŸim Teknolojileri ve Hizmetleri A.Åž., L = Ankara, C = TR
545 "2.16.792.3.0.4.1.1.4",
547 { 0xB0, 0xBF, 0xD5, 0x2B, 0xB0, 0xD7, 0xD9, 0xBD, 0x92, 0xBF, 0x5D,
548 0x4D, 0xC1, 0x3D, 0xA2, 0x55, 0xC0, 0x2C, 0x54, 0x2F, 0x37, 0x83,
549 0x65, 0xEA, 0x89, 0x39, 0x11, 0xF5, 0x5E, 0x55, 0xF2, 0x3C },
550 "MIGyMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMUAwPgYDVQQKDDdFLVR1"
551 "xJ9yYSBFQkcgQmlsacWfaW0gVGVrbm9sb2ppbGVyaSB2ZSBIaXptZXRsZXJpIEEu"
552 "xZ4uMSYwJAYDVQQLDB1FLVR1Z3JhIFNlcnRpZmlrYXN5b24gTWVya2V6aTEoMCYG"
553 "A1UEAwwfRS1UdWdyYSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
557 // CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
560 { 0x55, 0x92, 0x60, 0x84, 0xEC, 0x96, 0x3A, 0x64, 0xB9, 0x6E, 0x2A,
561 0xBE, 0x01, 0xCE, 0x0B, 0xA8, 0x6A, 0x64, 0xFB, 0xFE, 0xBC, 0xC7,
562 0xAA, 0xB5, 0xAF, 0xC1, 0x55, 0xB3, 0x7F, 0xD7, 0x60, 0x66 },
563 "MGsxCzAJBgNVBAYTAklUMQ4wDAYDVQQHDAVNaWxhbjEjMCEGA1UECgwaQWN0YWxp"
564 "cyBTLnAuQS4vMDMzNTg1MjA5NjcxJzAlBgNVBAMMHkFjdGFsaXMgQXV0aGVudGlj"
565 "YXRpb24gUm9vdCBDQQ==",
569 // CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
570 "2.16.840.1.114412.2.1",
572 { 0x7D, 0x05, 0xEB, 0xB6, 0x82, 0x33, 0x9F, 0x8C, 0x94, 0x51, 0xEE,
573 0x09, 0x4E, 0xEB, 0xFE, 0xFA, 0x79, 0x53, 0xA1, 0x14, 0xED, 0xB2,
574 0xF4, 0x49, 0x49, 0x45, 0x2F, 0xAB, 0x7D, 0x2F, 0xC1, 0x85 },
575 "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
576 "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
578 "C5McOtY5Z+pnI7/Dr5r0Sw==",
581 // CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
582 "2.16.840.1.114412.2.1",
584 { 0x7E, 0x37, 0xCB, 0x8B, 0x4C, 0x47, 0x09, 0x0C, 0xAB, 0x36, 0x55,
585 0x1B, 0xA6, 0xF4, 0x5D, 0xB8, 0x40, 0x68, 0x0F, 0xBA, 0x16, 0x6A,
586 0x95, 0x2D, 0xB1, 0x00, 0x71, 0x7F, 0x43, 0x05, 0x3F, 0xC2 },
587 "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
588 "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
590 "C6Fa+h3foLVJRK/NJKBs7A==",
593 // CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
594 "2.16.840.1.114412.2.1",
596 { 0xCB, 0x3C, 0xCB, 0xB7, 0x60, 0x31, 0xE5, 0xE0, 0x13, 0x8F, 0x8D,
597 0xD3, 0x9A, 0x23, 0xF9, 0xDE, 0x47, 0xFF, 0xC3, 0x5E, 0x43, 0xC1,
598 0x14, 0x4C, 0xEA, 0x27, 0xD4, 0x6A, 0x5A, 0xB1, 0xCB, 0x5F },
599 "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
600 "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
602 "Azrx5qcRqaC7KGSxHQn65Q==",
605 // CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
606 "2.16.840.1.114412.2.1",
608 { 0x31, 0xAD, 0x66, 0x48, 0xF8, 0x10, 0x41, 0x38, 0xC7, 0x38, 0xF3,
609 0x9E, 0xA4, 0x32, 0x01, 0x33, 0x39, 0x3E, 0x3A, 0x18, 0xCC, 0x02,
610 0x29, 0x6E, 0xF9, 0x7C, 0x2A, 0xC9, 0xEF, 0x67, 0x31, 0xD0 },
611 "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
612 "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
614 "BVVWvPJepDU1w6QP1atFcg==",
617 // CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
618 "2.16.840.1.114412.2.1",
620 { 0x55, 0x2F, 0x7B, 0xDC, 0xF1, 0xA7, 0xAF, 0x9E, 0x6C, 0xE6, 0x72,
621 0x01, 0x7F, 0x4F, 0x12, 0xAB, 0xF7, 0x72, 0x40, 0xC7, 0x8E, 0x76,
622 0x1A, 0xC2, 0x03, 0xD1, 0xD9, 0xD2, 0x0A, 0xC8, 0x99, 0x88 },
623 "MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
624 "EHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9v"
626 "BZsbV56OITLiOQe9p3d1XA==",
629 // CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
630 "1.3.6.1.4.1.8024.0.2.100.1.2",
632 { 0x8F, 0xE4, 0xFB, 0x0A, 0xF9, 0x3A, 0x4D, 0x0D, 0x67, 0xDB, 0x0B,
633 0xEB, 0xB2, 0x3E, 0x37, 0xC7, 0x1B, 0xF3, 0x25, 0xDC, 0xBC, 0xDD,
634 0x24, 0x0E, 0xA0, 0x4D, 0xAF, 0x58, 0xB4, 0x7E, 0x18, 0x40 },
635 "MEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYD"
636 "VQQDExVRdW9WYWRpcyBSb290IENBIDIgRzM=",
637 "RFc0JFuBiZs18s64KztbpybwdSg=",
640 // CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
641 "1.3.6.1.4.1.6449.1.2.1.5.1",
643 { 0x52, 0xF0, 0xE1, 0xC4, 0xE5, 0x8E, 0xC6, 0x29, 0x29, 0x1B, 0x60,
644 0x31, 0x7F, 0x07, 0x46, 0x71, 0xB8, 0x5D, 0x7E, 0xA8, 0x0D, 0x5B,
645 0x07, 0x27, 0x34, 0x63, 0x53, 0x4B, 0x32, 0xB4, 0x02, 0x34 },
646 "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
647 "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
648 "A1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
649 "TKr5yttjb+Af907YWwOGnQ==",
652 // CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
653 "1.3.6.1.4.1.6449.1.2.1.5.1",
655 { 0xE7, 0x93, 0xC9, 0xB0, 0x2F, 0xD8, 0xAA, 0x13, 0xE2, 0x1C, 0x31,
656 0x22, 0x8A, 0xCC, 0xB0, 0x81, 0x19, 0x64, 0x3B, 0x74, 0x9C, 0x89,
657 0x89, 0x64, 0xB1, 0x74, 0x6D, 0x46, 0xC3, 0xD4, 0xCB, 0xD2 },
658 "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
659 "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
660 "A1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
661 "Af1tMPyjylGoG7xkDjUDLQ==",
664 // CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
665 "1.3.6.1.4.1.6449.1.2.1.5.1",
667 { 0x4F, 0xF4, 0x60, 0xD5, 0x4B, 0x9C, 0x86, 0xDA, 0xBF, 0xBC, 0xFC,
668 0x57, 0x12, 0xE0, 0x40, 0x0D, 0x2B, 0xED, 0x3F, 0xBC, 0x4D, 0x4F,
669 0xBD, 0xAA, 0x86, 0xE0, 0x6A, 0xDC, 0xD2, 0xA9, 0xAD, 0x7A },
670 "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
671 "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
672 "A1UEAxMlVVNFUlRydXN0IEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
673 "XIuZxVqUxdJxVt7NiYDMJg==",
676 // CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
678 "CA/Browser Forum EV OID",
679 { 0x17, 0x9F, 0xBC, 0x14, 0x8A, 0x3D, 0xD0, 0x0F, 0xD2, 0x4E, 0xA1,
680 0x34, 0x58, 0xCC, 0x43, 0xBF, 0xA7, 0xF5, 0x9C, 0x81, 0x82, 0xD7,
681 0x83, 0xA5, 0x13, 0xF6, 0xEB, 0xEC, 0x10, 0x0C, 0x89, 0x24 },
682 "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UE"
683 "ChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
684 "YFlJ4CYuu1X5CneKcflK2Gw=",
687 // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6
689 "CA/Browser Forum EV OID",
690 { 0x2C, 0xAB, 0xEA, 0xFE, 0x37, 0xD0, 0x6C, 0xA2, 0x2A, 0xBA, 0x73,
691 0x91, 0xC0, 0x03, 0x3D, 0x25, 0x98, 0x29, 0x52, 0xC4, 0x53, 0x64,
692 0x73, 0x49, 0x76, 0x3A, 0x3A, 0xB5, 0xAD, 0x6C, 0xCF, 0x69 },
693 "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFI2MRMwEQYDVQQKEwpH"
694 "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
695 "Rea7A4Mzw4VlSOb/RVE=",
698 // CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
699 "2.16.840.1.114028.10.1.2",
701 { 0x6D, 0xC4, 0x71, 0x72, 0xE0, 0x1C, 0xBC, 0xB0, 0xBF, 0x62, 0x58,
702 0x0D, 0x89, 0x5F, 0xE2, 0xB8, 0xAC, 0x9A, 0xD4, 0xF8, 0x73, 0x80,
703 0x1E, 0x0C, 0x10, 0xB9, 0xC8, 0x37, 0xD2, 0x1E, 0xB1, 0x77 },
704 "MIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3Qu"
705 "bmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMG"
706 "A1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50"
707 "cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp",
711 // CN=Staat der Nederlanden EV Root CA,O=Staat der Nederlanden,C=NL
712 "2.16.528.1.1003.1.2.7",
713 "Staat der Nederlanden EV OID",
714 { 0x4D, 0x24, 0x91, 0x41, 0x4C, 0xFE, 0x95, 0x67, 0x46, 0xEC, 0x4C,
715 0xEF, 0xA6, 0xCF, 0x6F, 0x72, 0xE2, 0x8A, 0x13, 0x29, 0x43, 0x2F,
716 0x9D, 0x8A, 0x90, 0x7A, 0xC4, 0xCB, 0x5D, 0xAD, 0xC1, 0x5A },
717 "MFgxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVTdGFhdCBkZXIgTmVkZXJsYW5kZW4x"
718 "KTAnBgNVBAMMIFN0YWF0IGRlciBOZWRlcmxhbmRlbiBFViBSb290IENB",
722 // CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
723 "2.16.840.1.114028.10.1.2",
725 { 0x43, 0xDF, 0x57, 0x74, 0xB0, 0x3E, 0x7F, 0xEF, 0x5F, 0xE4, 0x0D,
726 0x93, 0x1A, 0x7B, 0xED, 0xF1, 0xBB, 0x2E, 0x6B, 0x42, 0x73, 0x8C,
727 0x4E, 0x6D, 0x38, 0x41, 0x10, 0x3D, 0x3A, 0xA7, 0xF3, 0x39 },
728 "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
729 "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
730 "IDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
731 "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
736 // CN=Entrust Root Certification Authority - EC1,OU="(c) 2012 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
737 "2.16.840.1.114028.10.1.2",
739 { 0x02, 0xED, 0x0E, 0xB2, 0x8C, 0x14, 0xDA, 0x45, 0x16, 0x5C, 0x56,
740 0x67, 0x91, 0x70, 0x0D, 0x64, 0x51, 0xD7, 0xFB, 0x56, 0xF0, 0xB2,
741 0xAB, 0x1D, 0x3B, 0x8E, 0xB0, 0x70, 0xE5, 0x6E, 0xDF, 0xF5 },
742 "MIG/MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
743 "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
744 "IDIwMTIgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTMw"
745 "MQYDVQQDEypFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBF"
747 "AKaLeSkAAAAAUNCR+Q==",
750 // CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN
753 { 0x5C, 0xC3, 0xD7, 0x8E, 0x4E, 0x1D, 0x5E, 0x45, 0x54, 0x7A, 0x04,
754 0xE6, 0x87, 0x3E, 0x64, 0xF9, 0x0C, 0xF9, 0x53, 0x6D, 0x1C, 0xCC,
755 0x2E, 0xF8, 0x00, 0xF3, 0x55, 0xC4, 0xC5, 0xFD, 0x70, 0xFD },
756 "MFYxCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlm"
757 "aWNhdGlvbiBBdXRob3JpdHkxFTATBgNVBAMMDENGQ0EgRVYgUk9PVA==",
761 // OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP
762 "1.2.392.200091.100.721.1",
764 { 0x51, 0x3B, 0x2C, 0xEC, 0xB8, 0x10, 0xD4, 0xCD, 0xE5, 0xDD, 0x85,
765 0x39, 0x1A, 0xDF, 0xC6, 0xC2, 0xDD, 0x60, 0xD8, 0x7B, 0xB7, 0x36,
766 0xD2, 0xB5, 0x21, 0x48, 0x4A, 0xA4, 0x7A, 0x0E, 0xBE, 0xF6 },
767 "MF0xCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
768 "LixMVEQuMScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTI=",
772 // CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
773 "2.16.756.5.14.7.4.8",
775 { 0x6B, 0x9C, 0x08, 0xE8, 0x6E, 0xB0, 0xF7, 0x67, 0xCF, 0xAD, 0x65,
776 0xCD, 0x98, 0xB6, 0x21, 0x49, 0xE5, 0x49, 0x4A, 0x67, 0xF5, 0x84,
777 0x5E, 0x7B, 0xD1, 0xED, 0x01, 0x9F, 0x27, 0xB8, 0x6B, 0xD6 },
778 "MG0xCzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNU"
779 "RSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEds"
780 "b2JhbCBSb290IEdCIENB",
781 "drEgUnTwhYdGs/gjGvbCwA==",
784 // CN=Amazon Root CA 1,O=Amazon,C=US
786 "CA/Browser Forum EV OID",
787 { 0x8E, 0xCD, 0xE6, 0x88, 0x4F, 0x3D, 0x87, 0xB1, 0x12, 0x5B, 0xA3,
788 0x1A, 0xC3, 0xFC, 0xB1, 0x3D, 0x70, 0x16, 0xDE, 0x7F, 0x57, 0xCC,
789 0x90, 0x4F, 0xE1, 0xCB, 0x97, 0xC6, 0xAE, 0x98, 0x19, 0x6E },
790 "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
792 "Bmyfz5m/jAo54vB4ikPmljZbyg==",
795 // CN=Amazon Root CA 2,O=Amazon,C=US
797 "CA/Browser Forum EV OID",
798 { 0x1B, 0xA5, 0xB2, 0xAA, 0x8C, 0x65, 0x40, 0x1A, 0x82, 0x96, 0x01,
799 0x18, 0xF8, 0x0B, 0xEC, 0x4F, 0x62, 0x30, 0x4D, 0x83, 0xCE, 0xC4,
800 0x71, 0x3A, 0x19, 0xC3, 0x9C, 0x01, 0x1E, 0xA4, 0x6D, 0xB4 },
801 "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
803 "Bmyf0pY1hp8KD+WGePhbJruKNw==",
806 // CN=Amazon Root CA 3,O=Amazon,C=US
808 "CA/Browser Forum EV OID",
809 { 0x18, 0xCE, 0x6C, 0xFE, 0x7B, 0xF1, 0x4E, 0x60, 0xB2, 0xE3, 0x47,
810 0xB8, 0xDF, 0xE8, 0x68, 0xCB, 0x31, 0xD0, 0x2E, 0xBB, 0x3A, 0xDA,
811 0x27, 0x15, 0x69, 0xF5, 0x03, 0x43, 0xB4, 0x6D, 0xB3, 0xA4 },
812 "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
814 "Bmyf1XSXNmY/Owua2eiedgPySg==",
817 // CN=Amazon Root CA 4,O=Amazon,C=US
819 "CA/Browser Forum EV OID",
820 { 0xE3, 0x5D, 0x28, 0x41, 0x9E, 0xD0, 0x20, 0x25, 0xCF, 0xA6, 0x90,
821 0x38, 0xCD, 0x62, 0x39, 0x62, 0x45, 0x8D, 0xA5, 0xC6, 0x95, 0xFB,
822 0xDE, 0xA3, 0xC2, 0x2B, 0x0B, 0xFB, 0x25, 0x89, 0x70, 0x92 },
823 "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
825 "Bmyf18G7EEwpQ+Vxe3ssyBrBDg==",
828 // CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
830 "CA/Browser Forum EV OID",
831 { 0x56, 0x8D, 0x69, 0x05, 0xA2, 0xC8, 0x87, 0x08, 0xA4, 0xB3, 0x02,
832 0x51, 0x90, 0xED, 0xCF, 0xED, 0xB1, 0x97, 0x4A, 0x60, 0x6A, 0x13,
833 0xC6, 0xE5, 0x29, 0x0F, 0xCB, 0x2A, 0xE6, 0x3E, 0xDA, 0xB5 },
834 "MIGYMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
835 "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjE7"
836 "MDkGA1UEAxMyU3RhcmZpZWxkIFNlcnZpY2VzIFJvb3QgQ2VydGlmaWNhdGUgQXV0"
841 // CN=LuxTrust Global Root 2,O=LuxTrust S.A.,C=LU
842 "1.3.171.1.1.10.5.2",
844 { 0x54, 0x45, 0x5F, 0x71, 0x29, 0xC2, 0x0B, 0x14, 0x47, 0xC4, 0x18,
845 0xF9, 0x97, 0x16, 0x8F, 0x24, 0xC5, 0x8F, 0xC5, 0x02, 0x3B, 0xF5,
846 0xDA, 0x5B, 0xE2, 0xEB, 0x6E, 0x1D, 0xD8, 0x90, 0x2E, 0xD5 },
847 "MEYxCzAJBgNVBAYTAkxVMRYwFAYDVQQKDA1MdXhUcnVzdCBTLkEuMR8wHQYDVQQD"
848 "DBZMdXhUcnVzdCBHbG9iYWwgUm9vdCAy",
849 "Cn6m30tEntpqJIWe5rgV0xZ/u7E=",
852 // CN=GDCA TrustAUTH R5 ROOT,O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.",C=CN
853 "1.2.156.112559.1.1.6.1",
855 { 0xBF, 0xFF, 0x8F, 0xD0, 0x44, 0x33, 0x48, 0x7D, 0x6A, 0x8A, 0xA6,
856 0x0C, 0x1A, 0x29, 0x76, 0x7A, 0x9F, 0xC2, 0xBB, 0xB0, 0x5E, 0x42,
857 0x0F, 0x71, 0x3A, 0x13, 0xB9, 0x92, 0x89, 0x1D, 0x38, 0x93 },
858 "MGIxCzAJBgNVBAYTAkNOMTIwMAYDVQQKDClHVUFORyBET05HIENFUlRJRklDQVRF"
859 "IEFVVEhPUklUWSBDTy4sTFRELjEfMB0GA1UEAwwWR0RDQSBUcnVzdEFVVEggUjUg"
864 // CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
866 "CA/Browser Forum EV OID",
867 { 0x22, 0xA2, 0xC1, 0xF7, 0xBD, 0xED, 0x70, 0x4C, 0xC1, 0xE7, 0x01,
868 0xB5, 0xF4, 0x08, 0xC3, 0x10, 0x88, 0x0F, 0xE9, 0x56, 0xB5, 0xDE,
869 0x2A, 0x4A, 0x44, 0xF9, 0x9C, 0x87, 0x3A, 0x25, 0xA7, 0xC8 },
870 "MH8xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv"
871 "bjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTQwMgYDVQQDDCtTU0wuY29tIEVW"
872 "IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgRUND",
876 // CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
878 "CA/Browser Forum EV OID",
879 { 0x2E, 0x7B, 0xF1, 0x6C, 0xC2, 0x24, 0x85, 0xA7, 0xBB, 0xE2, 0xAA,
880 0x86, 0x96, 0x75, 0x07, 0x61, 0xB0, 0xAE, 0x39, 0xBE, 0x3B, 0x2F,
881 0xE9, 0xD0, 0xCC, 0x6D, 0x4E, 0xF7, 0x34, 0x91, 0x42, 0x5C },
882 "MIGCMQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0"
883 "b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE3MDUGA1UEAwwuU1NMLmNvbSBF"
884 "ViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQSBSMg==",
888 // CN=UCA Extended Validation Root,O=UniTrust,C=CN
890 "CA/Browser Forum EV OID",
891 { 0xD4, 0x3A, 0xF9, 0xB3, 0x54, 0x73, 0x75, 0x5C, 0x96, 0x84, 0xFC,
892 0x06, 0xD7, 0xD8, 0xCB, 0x70, 0xEE, 0x5C, 0x28, 0xE7, 0x73, 0xFB,
893 0x29, 0x4E, 0xB4, 0x1E, 0xE7, 0x17, 0x22, 0x92, 0x4D, 0x24 },
894 "MEcxCzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlUcnVzdDElMCMGA1UEAwwcVUNB"
895 "IEV4dGVuZGVkIFZhbGlkYXRpb24gUm9vdA==",
896 "T9Irj/VkyDOeTzRYZiNwYA==",
899 // CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
901 "CA/Browser Forum EV OID",
902 { 0x5A, 0x2F, 0xC0, 0x3F, 0x0C, 0x83, 0xB0, 0x90, 0xBB, 0xFA, 0x40,
903 0x60, 0x4B, 0x09, 0x88, 0x44, 0x6C, 0x76, 0x36, 0x18, 0x3D, 0xF9,
904 0x84, 0x6E, 0x17, 0x10, 0x1A, 0x44, 0x7F, 0xB8, 0xEF, 0xD6 },
905 "MG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtvbmcxEjAQBgNVBAcTCUhv"
906 "bmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMXSG9uZ2tv"
907 "bmcgUG9zdCBSb290IENBIDM=",
908 "CBZfikyl7ADJk0DfxMauI7gcWqQ=",
911 // CN=emSign Root CA - G1,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
913 "CA/Browser Forum EV OID",
914 { 0x40, 0xF6, 0xAF, 0x03, 0x46, 0xA9, 0x9A, 0xA1, 0xCD, 0x1D, 0x55,
915 0x5A, 0x4E, 0x9C, 0xCE, 0x62, 0xC7, 0xF9, 0x63, 0x46, 0x03, 0xEE,
916 0x40, 0x66, 0x15, 0x83, 0x3D, 0xC8, 0xC8, 0xD0, 0x03, 0x67 },
917 "MGcxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxl"
918 "TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9v"
923 // CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
925 "CA/Browser Forum EV OID",
926 { 0x86, 0xA1, 0xEC, 0xBA, 0x08, 0x9C, 0x4A, 0x8D, 0x3B, 0xBE, 0x27,
927 0x34, 0xC6, 0x12, 0xBA, 0x34, 0x1D, 0x81, 0x3E, 0x04, 0x3C, 0xF9,
928 0xE8, 0xA8, 0x62, 0xCD, 0x5C, 0x57, 0xA3, 0x6B, 0xBE, 0x6B },
929 "MGsxCzAJBgNVBAYTAklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxl"
930 "TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMSAwHgYDVQQDExdlbVNpZ24gRUND"
931 "IFJvb3QgQ0EgLSBHMw==",
935 // CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
937 "CA/Browser Forum EV OID",
938 { 0x12, 0x56, 0x09, 0xAA, 0x30, 0x1D, 0xA0, 0xA2, 0x49, 0xB9, 0x7A,
939 0x82, 0x39, 0xCB, 0x6A, 0x34, 0x21, 0x6F, 0x44, 0xDC, 0xAC, 0x9F,
940 0x39, 0x54, 0xB1, 0x42, 0x92, 0xF2, 0xE8, 0xC8, 0x60, 0x8F },
941 "MFYxCzAJBgNVBAYTAlVTMRMwEQYDVQQLEwplbVNpZ24gUEtJMRQwEgYDVQQKEwtl"
942 "TXVkaHJhIEluYzEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBDMQ==",
946 // CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
948 "CA/Browser Forum EV OID",
949 { 0xBC, 0x4D, 0x80, 0x9B, 0x15, 0x18, 0x9D, 0x78, 0xDB, 0x3E, 0x1D,
950 0x8C, 0xF4, 0xF9, 0x72, 0x6A, 0x79, 0x5D, 0xA1, 0x64, 0x3C, 0xA5,
951 0xF1, 0x35, 0x8E, 0x1D, 0xDB, 0x0E, 0xDC, 0x0D, 0x7E, 0xB3 },
952 "MFoxCzAJBgNVBAYTAlVTMRMwEQYDVQQLEwplbVNpZ24gUEtJMRQwEgYDVQQKEwtl"
953 "TXVkaHJhIEluYzEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gQzM=",
959 static SECOidTag sEVInfoOIDTags
[ArrayLength(kEVInfos
)];
961 static_assert(SEC_OID_UNKNOWN
== 0,
962 "We depend on zero-initialized globals being interpreted as "
965 ArrayLength(sEVInfoOIDTags
) == ArrayLength(kEVInfos
),
966 "These arrays are used in parallel and must have the same length.");
968 static SECOidTag
RegisterOID(const SECItem
& oidItem
, const char* oidName
) {
970 od
.oid
.len
= oidItem
.len
;
971 od
.oid
.data
= oidItem
.data
;
972 od
.offset
= SEC_OID_UNKNOWN
;
974 od
.mechanism
= CKM_INVALID_MECHANISM
;
975 od
.supportedExtension
= INVALID_CERT_EXTENSION
;
976 return SECOID_AddEntry(&od
);
979 static SECOidTag sCABForumEVOIDTag
= SEC_OID_UNKNOWN
;
981 static bool isEVPolicy(SECOidTag policyOIDTag
) {
982 if (policyOIDTag
!= SEC_OID_UNKNOWN
&& policyOIDTag
== sCABForumEVOIDTag
) {
986 for (const SECOidTag
& oidTag
: sEVInfoOIDTags
) {
987 if (policyOIDTag
== oidTag
) {
995 bool CertIsAuthoritativeForEVPolicy(const UniqueCERTCertificate
& cert
,
996 const mozilla::pkix::CertPolicyId
& policy
) {
1002 unsigned char fingerprint
[SHA256_LENGTH
];
1003 SECStatus srv
= PK11_HashBuf(SEC_OID_SHA256
, fingerprint
, cert
->derCert
.data
,
1004 AssertedCast
<int32_t>(cert
->derCert
.len
));
1005 if (srv
!= SECSuccess
) {
1009 const SECOidData
* cabforumOIDData
= SECOID_FindOIDByTag(sCABForumEVOIDTag
);
1010 for (size_t i
= 0; i
< ArrayLength(kEVInfos
); ++i
) {
1011 const EVInfo
& entry
= kEVInfos
[i
];
1013 // This check ensures that only the specific roots we approve for EV get
1014 // that status, and not certs (roots or otherwise) that happen to have an
1015 // OID that's already been approved for EV.
1016 if (!ArrayEqual(fingerprint
, entry
.sha256Fingerprint
)) {
1020 if (cabforumOIDData
&& cabforumOIDData
->oid
.len
== policy
.numBytes
&&
1021 ArrayEqual(cabforumOIDData
->oid
.data
, policy
.bytes
, policy
.numBytes
)) {
1024 const SECOidData
* oidData
= SECOID_FindOIDByTag(sEVInfoOIDTags
[i
]);
1025 if (oidData
&& oidData
->oid
.len
== policy
.numBytes
&&
1026 ArrayEqual(oidData
->oid
.data
, policy
.bytes
, policy
.numBytes
)) {
1034 nsresult
LoadExtendedValidationInfo() {
1035 static const char* sCABForumOIDString
= "2.23.140.1.1";
1036 static const char* sCABForumOIDDescription
= "CA/Browser Forum EV OID";
1038 ScopedAutoSECItem cabforumOIDItem
;
1039 if (SEC_StringToOID(nullptr, &cabforumOIDItem
, sCABForumOIDString
, 0) !=
1041 return NS_ERROR_FAILURE
;
1043 sCABForumEVOIDTag
= RegisterOID(cabforumOIDItem
, sCABForumOIDDescription
);
1044 if (sCABForumEVOIDTag
== SEC_OID_UNKNOWN
) {
1045 return NS_ERROR_FAILURE
;
1048 for (size_t i
= 0; i
< ArrayLength(kEVInfos
); ++i
) {
1049 const EVInfo
& entry
= kEVInfos
[i
];
1053 // This section of code double-checks that we calculated the correct
1054 // certificate hash given the issuer and serial number and that it is
1055 // actually present in our loaded root certificates module. It is
1056 // unnecessary to check this in non-debug builds since we will safely fall
1057 // back to DV if the EV information is incorrect.
1058 nsAutoCString derIssuer
;
1060 Base64Decode(nsDependentCString(entry
.issuerBase64
), derIssuer
);
1061 MOZ_ASSERT(NS_SUCCEEDED(rv
), "Could not base64-decode built-in EV issuer");
1062 if (NS_FAILED(rv
)) {
1066 nsAutoCString serialNumber
;
1067 rv
= Base64Decode(nsDependentCString(entry
.serialBase64
), serialNumber
);
1068 MOZ_ASSERT(NS_SUCCEEDED(rv
), "Could not base64-decode built-in EV serial");
1069 if (NS_FAILED(rv
)) {
1073 CERTIssuerAndSN ias
;
1074 ias
.derIssuer
.data
=
1075 BitwiseCast
<unsigned char*, const char*>(derIssuer
.get());
1076 ias
.derIssuer
.len
= derIssuer
.Length();
1077 ias
.serialNumber
.data
=
1078 BitwiseCast
<unsigned char*, const char*>(serialNumber
.get());
1079 ias
.serialNumber
.len
= serialNumber
.Length();
1080 ias
.serialNumber
.type
= siUnsignedInteger
;
1082 UniqueCERTCertificate
cert(CERT_FindCertByIssuerAndSN(nullptr, &ias
));
1084 // If an entry is missing in the NSS root database, it may be because the
1085 // root database is out of sync with what we expect (e.g. a different
1086 // version of system NSS is installed).
1088 // The entries for the debug EV roots are at indices 0 through
1089 // NUM_TEST_EV_ROOTS - 1. Since they're not built-in, they probably
1090 // haven't been loaded yet.
1091 MOZ_ASSERT(i
< NUM_TEST_EV_ROOTS
, "Could not find built-in EV root");
1093 unsigned char certFingerprint
[SHA256_LENGTH
];
1094 srv
= PK11_HashBuf(SEC_OID_SHA256
, certFingerprint
, cert
->derCert
.data
,
1095 AssertedCast
<int32_t>(cert
->derCert
.len
));
1096 MOZ_ASSERT(srv
== SECSuccess
, "Could not hash EV root");
1097 if (srv
!= SECSuccess
) {
1098 return NS_ERROR_FAILURE
;
1100 bool same
= ArrayEqual(certFingerprint
, entry
.sha256Fingerprint
);
1101 MOZ_ASSERT(same
, "EV root fingerprint mismatch");
1103 return NS_ERROR_FAILURE
;
1107 // This is the code that actually enables these roots for EV.
1108 ScopedAutoSECItem evOIDItem
;
1109 srv
= SEC_StringToOID(nullptr, &evOIDItem
, entry
.dottedOid
, 0);
1110 MOZ_ASSERT(srv
== SECSuccess
, "SEC_StringToOID failed");
1111 if (srv
!= SECSuccess
) {
1112 return NS_ERROR_FAILURE
;
1114 sEVInfoOIDTags
[i
] = RegisterOID(evOIDItem
, entry
.oidName
);
1115 if (sEVInfoOIDTags
[i
] == SEC_OID_UNKNOWN
) {
1116 return NS_ERROR_FAILURE
;
1123 // Helper function for GetFirstEVPolicy(): returns the first suitable policy
1124 // from the given list of policies.
1125 bool GetFirstEVPolicyFromPolicyList(
1126 const UniqueCERTCertificatePolicies
& policies
,
1127 /*out*/ mozilla::pkix::CertPolicyId
& policy
,
1128 /*out*/ SECOidTag
& policyOidTag
) {
1129 for (size_t i
= 0; policies
->policyInfos
[i
]; i
++) {
1130 const CERTPolicyInfo
* policyInfo
= policies
->policyInfos
[i
];
1131 SECOidTag policyInfoOID
= policyInfo
->oid
;
1132 if (policyInfoOID
== SEC_OID_UNKNOWN
|| !isEVPolicy(policyInfoOID
)) {
1136 const SECOidData
* oidData
= SECOID_FindOIDByTag(policyInfoOID
);
1137 MOZ_ASSERT(oidData
);
1138 MOZ_ASSERT(oidData
->oid
.data
);
1139 MOZ_ASSERT(oidData
->oid
.len
> 0);
1140 MOZ_ASSERT(oidData
->oid
.len
<= mozilla::pkix::CertPolicyId::MAX_BYTES
);
1141 if (!oidData
|| !oidData
->oid
.data
|| oidData
->oid
.len
== 0 ||
1142 oidData
->oid
.len
> mozilla::pkix::CertPolicyId::MAX_BYTES
) {
1146 policy
.numBytes
= AssertedCast
<uint16_t>(oidData
->oid
.len
);
1147 PodCopy(policy
.bytes
, oidData
->oid
.data
, policy
.numBytes
);
1148 policyOidTag
= policyInfoOID
;
1155 bool GetFirstEVPolicy(CERTCertificate
& cert
,
1156 /*out*/ mozilla::pkix::CertPolicyId
& policy
,
1157 /*out*/ SECOidTag
& policyOidTag
) {
1158 if (!cert
.extensions
) {
1162 for (size_t i
= 0; cert
.extensions
[i
]; i
++) {
1163 const CERTCertExtension
* extension
= cert
.extensions
[i
];
1164 if (SECOID_FindOIDTag(&extension
->id
) !=
1165 SEC_OID_X509_CERTIFICATE_POLICIES
) {
1169 UniqueCERTCertificatePolicies
policies(
1170 CERT_DecodeCertificatePoliciesExtension(&extension
->value
));
1175 if (GetFirstEVPolicyFromPolicyList(policies
, policy
, policyOidTag
)) {
1184 } // namespace mozilla