Line data Source code
1 : /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
2 : *
3 : * This Source Code Form is subject to the terms of the Mozilla Public
4 : * License, v. 2.0. If a copy of the MPL was not distributed with this
5 : * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
6 :
7 : #include "ExtendedValidation.h"
8 :
9 : #include "cert.h"
10 : #include "hasht.h"
11 : #include "mozilla/ArrayUtils.h"
12 : #include "mozilla/Assertions.h"
13 : #include "mozilla/Base64.h"
14 : #include "mozilla/Casting.h"
15 : #include "mozilla/PodOperations.h"
16 : #include "nsDependentString.h"
17 : #include "nsString.h"
18 : #include "pk11pub.h"
19 : #include "pkix/pkixtypes.h"
20 :
21 : namespace mozilla { namespace psm {
22 :
23 : struct EVInfo
24 : {
25 : // See bug 1338873 about making these fields const.
26 : const char* dottedOid;
27 : const char* oidName; // Set this to null to signal an invalid structure,
28 : // (We can't have an empty list, so we'll use a dummy entry)
29 : unsigned char sha256Fingerprint[SHA256_LENGTH];
30 : const char* issuerBase64;
31 : const char* serialBase64;
32 : };
33 :
34 : // HOWTO enable additional CA root certificates for EV:
35 : //
36 : // For each combination of "root certificate" and "policy OID",
37 : // one entry must be added to the array named kEVInfos.
38 : //
39 : // We use the combination of "issuer name" and "serial number" to
40 : // uniquely identify the certificate. In order to avoid problems
41 : // because of encodings when comparing certificates, we don't
42 : // use plain text representation, we rather use the original encoding
43 : // as it can be found in the root certificate (in base64 format).
44 : //
45 : // We can use the NSS utility named "pp" to extract the encoding.
46 : //
47 : // Build standalone NSS including the NSS tools, then run
48 : // pp -t certificate-identity -i the-cert-filename
49 : //
50 : // You will need the output from sections "Issuer", "Fingerprint (SHA-256)",
51 : // "Issuer DER Base64" and "Serial DER Base64".
52 : //
53 : // The new section consists of the following components:
54 : //
55 : // - a comment that should contain the human readable issuer name
56 : // of the certificate, as printed by the pp tool
57 : // - the EV policy OID that is associated to the EV grant
58 : // - a text description of the EV policy OID. The array can contain
59 : // multiple entries with the same OID.
60 : // Please make sure to use the identical OID text description for
61 : // all entries with the same policy OID (use the text search
62 : // feature of your text editor to find duplicates).
63 : // When adding a new policy OID that is not yet contained in the array,
64 : // please make sure that your new description is different from
65 : // all the other descriptions (again use the text search feature
66 : // to be sure).
67 : // - the SHA-256 fingerprint
68 : // - the "Issuer DER Base64" as printed by the pp tool.
69 : // Remove all whitespaces. If you use multiple lines, make sure that
70 : // only the final line will be followed by a comma.
71 : // - the "Serial DER Base64" (as printed by pp)
72 : //
73 : // After adding an entry, test it locally against the test site that
74 : // has been provided by the CA. Note that you must use a version of NSS
75 : // where the root certificate has already been added and marked as trusted
76 : // for issuing SSL server certificates (at least).
77 : //
78 : // If you are able to connect to the site without certificate errors,
79 : // but you don't see the EV status indicator, then most likely the CA
80 : // has a problem in their infrastructure. The most common problems are
81 : // related to the CA's OCSP infrastructure, either they use an incorrect
82 : // OCSP signing certificate, or OCSP for the intermediate certificates
83 : // isn't working, or OCSP isn't working at all.
84 :
85 : #ifdef DEBUG
86 : static const size_t NUM_TEST_EV_ROOTS = 2;
87 : #endif
88 :
89 : static const struct EVInfo kEVInfos[] = {
90 : // IMPORTANT! When extending this list, if you add another entry that uses
91 : // the same dottedOid as an existing entry, use the same oidName.
92 : #ifdef DEBUG
93 : // Debug EV certificates should all use the following OID:
94 : // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
95 : // (multiple entries with the same OID is ok)
96 : // If you add or remove debug EV certs you must also modify NUM_TEST_EV_ROOTS
97 : // so that the correct number of certs are skipped as these debug EV certs are
98 : // NOT part of the default trust store.
99 : {
100 : // This is the PSM xpcshell testing EV certificate. It can be generated
101 : // using pycert.py and the following specification:
102 : //
103 : // issuer:evroot
104 : // subject:evroot
105 : // subjectKey:ev
106 : // issuerKey:ev
107 : // validity:20150101-20350101
108 : // extension:basicConstraints:cA,
109 : // extension:keyUsage:keyCertSign,cRLSign
110 : //
111 : // If this ever needs to change, re-generate the certificate and update the
112 : // following entry with the new fingerprint, issuer, and serial number.
113 : "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
114 : "DEBUGtesting EV OID",
115 : { 0xE4, 0xFB, 0x04, 0x16, 0x10, 0x32, 0x67, 0x08, 0x6C, 0x84, 0x2E,
116 : 0x91, 0xF3, 0xEF, 0x0E, 0x45, 0x99, 0xBC, 0xA8, 0x54, 0x73, 0xF5,
117 : 0x03, 0x2C, 0x7B, 0xDC, 0x09, 0x70, 0x76, 0x49, 0xBF, 0xAA },
118 : "MBExDzANBgNVBAMMBmV2cm9vdA==",
119 : "W9j5PS8YoKgynZdYa9i2Kwexnp8=",
120 : },
121 : {
122 : // This is an RSA root with an inadequate key size. It is used to test that
123 : // minimum key sizes are enforced when verifying for EV. It can be
124 : // generated using pycert.py and the following specification:
125 : //
126 : // issuer:ev_root_rsa_2040
127 : // subject:ev_root_rsa_2040
128 : // issuerKey:evRSA2040
129 : // subjectKey:evRSA2040
130 : // validity:20150101-20350101
131 : // extension:basicConstraints:cA,
132 : // extension:keyUsage:cRLSign,keyCertSign
133 : //
134 : // If this ever needs to change, re-generate the certificate and update the
135 : // following entry with the new fingerprint, issuer, and serial number.
136 : "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
137 : "DEBUGtesting EV OID",
138 : { 0x49, 0x46, 0x10, 0xF4, 0xF5, 0xB1, 0x96, 0xE7, 0xFB, 0xFA, 0x4D,
139 : 0xA6, 0x34, 0x03, 0xD0, 0x99, 0x22, 0xD4, 0x77, 0x20, 0x3F, 0x84,
140 : 0xE0, 0xDF, 0x1C, 0xAD, 0xB4, 0xC2, 0x76, 0xBB, 0x63, 0x24 },
141 : "MBsxGTAXBgNVBAMMEGV2X3Jvb3RfcnNhXzIwNDA=",
142 : "P1iIBgxk6kH+x64EUBTV3qoHuas=",
143 : },
144 : #endif
145 : {
146 : // OU=Security Communication EV RootCA1,O="SECOM Trust Systems CO.,LTD.",C=JP
147 : "1.2.392.200091.100.721.1",
148 : "SECOM EV OID",
149 : { 0xA2, 0x2D, 0xBA, 0x68, 0x1E, 0x97, 0x37, 0x6E, 0x2D, 0x39, 0x7D,
150 : 0x72, 0x8A, 0xAE, 0x3A, 0x9B, 0x62, 0x96, 0xB9, 0xFD, 0xBA, 0x60,
151 : 0xBC, 0x2E, 0x11, 0xF6, 0x47, 0xF2, 0xC6, 0x75, 0xFB, 0x37 },
152 : "MGAxCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
153 : "LixMVEQuMSowKAYDVQQLEyFTZWN1cml0eSBDb21tdW5pY2F0aW9uIEVWIFJvb3RD"
154 : "QTE=",
155 : "AA==",
156 : },
157 : {
158 : // CN=Cybertrust Global Root,O=Cybertrust, Inc
159 : "1.3.6.1.4.1.6334.1.100.1",
160 : "Cybertrust EV OID",
161 : { 0x96, 0x0A, 0xDF, 0x00, 0x63, 0xE9, 0x63, 0x56, 0x75, 0x0C, 0x29,
162 : 0x65, 0xDD, 0x0A, 0x08, 0x67, 0xDA, 0x0B, 0x9C, 0xBD, 0x6E, 0x77,
163 : 0x71, 0x4A, 0xEA, 0xFB, 0x23, 0x49, 0xAB, 0x39, 0x3D, 0xA3 },
164 : "MDsxGDAWBgNVBAoTD0N5YmVydHJ1c3QsIEluYzEfMB0GA1UEAxMWQ3liZXJ0cnVz"
165 : "dCBHbG9iYWwgUm9vdA==",
166 : "BAAAAAABD4WqLUg=",
167 : },
168 : {
169 : // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
170 : "2.16.756.1.89.1.2.1.1",
171 : "SwissSign EV OID",
172 : { 0x62, 0xDD, 0x0B, 0xE9, 0xB9, 0xF5, 0x0A, 0x16, 0x3E, 0xA0, 0xF8,
173 : 0xE7, 0x5C, 0x05, 0x3B, 0x1E, 0xCA, 0x57, 0xEA, 0x55, 0xC8, 0x68,
174 : 0x8F, 0x64, 0x7C, 0x68, 0x81, 0xF2, 0xC8, 0x35, 0x7B, 0x95 },
175 : "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
176 : "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
177 : "ALtAHEP1Xk+w",
178 : },
179 : {
180 : // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
181 : "1.3.6.1.4.1.23223.1.1.1",
182 : "StartCom EV OID",
183 : { 0xC7, 0x66, 0xA9, 0xBE, 0xF2, 0xD4, 0x07, 0x1C, 0x86, 0x3A, 0x31,
184 : 0xAA, 0x49, 0x20, 0xE8, 0x13, 0xB2, 0xD1, 0x98, 0x60, 0x8C, 0xB7,
185 : 0xB7, 0xCF, 0xE2, 0x11, 0x43, 0xB8, 0x36, 0xDF, 0x09, 0xEA },
186 : "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
187 : "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
188 : "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
189 : "AQ==",
190 : },
191 : {
192 : // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
193 : "1.3.6.1.4.1.23223.1.1.1",
194 : "StartCom EV OID",
195 : { 0xE1, 0x78, 0x90, 0xEE, 0x09, 0xA3, 0xFB, 0xF4, 0xF4, 0x8B, 0x9C,
196 : 0x41, 0x4A, 0x17, 0xD6, 0x37, 0xB7, 0xA5, 0x06, 0x47, 0xE9, 0xBC,
197 : 0x75, 0x23, 0x22, 0x72, 0x7F, 0xCC, 0x17, 0x42, 0xA9, 0x11 },
198 : "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
199 : "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
200 : "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
201 : "LQ==",
202 : },
203 : {
204 : // CN=StartCom Certification Authority G2,O=StartCom Ltd.,C=IL
205 : "1.3.6.1.4.1.23223.1.1.1",
206 : "StartCom EV OID",
207 : { 0xC7, 0xBA, 0x65, 0x67, 0xDE, 0x93, 0xA7, 0x98, 0xAE, 0x1F, 0xAA,
208 : 0x79, 0x1E, 0x71, 0x2D, 0x37, 0x8F, 0xAE, 0x1F, 0x93, 0xC4, 0x39,
209 : 0x7F, 0xEA, 0x44, 0x1B, 0xB7, 0xCB, 0xE6, 0xFD, 0x59, 0x95 },
210 : "MFMxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSwwKgYDVQQD"
211 : "EyNTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHMg==",
212 : "Ow==",
213 : },
214 : {
215 : // CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU="(c) 2006 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
216 : "2.16.840.1.113733.1.7.23.6",
217 : "VeriSign EV OID",
218 : { 0x9A, 0xCF, 0xAB, 0x7E, 0x43, 0xC8, 0xD8, 0x80, 0xD0, 0x6B, 0x26,
219 : 0x2A, 0x94, 0xDE, 0xEE, 0xE4, 0xB4, 0x65, 0x99, 0x89, 0xC3, 0xD0,
220 : 0xCA, 0xF1, 0x9B, 0xAF, 0x64, 0x05, 0xE4, 0x1A, 0xB7, 0xDF },
221 : "MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
222 : "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZl"
223 : "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMT"
224 : "PFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB"
225 : "dXRob3JpdHkgLSBHNQ==",
226 : "GNrRniZ96LtKIVjNzGs7Sg==",
227 : },
228 : {
229 : // CN=GeoTrust Primary Certification Authority,O=GeoTrust Inc.,C=US
230 : "1.3.6.1.4.1.14370.1.6",
231 : "GeoTrust EV OID",
232 : { 0x37, 0xD5, 0x10, 0x06, 0xC5, 0x12, 0xEA, 0xAB, 0x62, 0x64, 0x21,
233 : 0xF1, 0xEC, 0x8C, 0x92, 0x01, 0x3F, 0xC5, 0xF8, 0x2A, 0xE9, 0x8E,
234 : 0xE5, 0x33, 0xEB, 0x46, 0x19, 0xB8, 0xDE, 0xB4, 0xD0, 0x6C },
235 : "MFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTEwLwYDVQQD"
236 : "EyhHZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
237 : "GKy1av1pthU6Y2yv2vrEoQ==",
238 : },
239 : {
240 : // CN=thawte Primary Root CA,OU="(c) 2006 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
241 : "2.16.840.1.113733.1.7.48.1",
242 : "Thawte EV OID",
243 : { 0x8D, 0x72, 0x2F, 0x81, 0xA9, 0xC1, 0x13, 0xC0, 0x79, 0x1D, 0xF1,
244 : 0x36, 0xA2, 0x96, 0x6D, 0xB2, 0x6C, 0x95, 0x0A, 0x97, 0x1D, 0xB4,
245 : 0x6B, 0x41, 0x99, 0xF4, 0xEA, 0x54, 0xB7, 0x8B, 0xFB, 0x9F },
246 : "MIGpMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
247 : "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
248 : "MjAwNiB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEfMB0G"
249 : "A1UEAxMWdGhhd3RlIFByaW1hcnkgUm9vdCBDQQ==",
250 : "NE7VVyDV7exJ9C/ON9srbQ==",
251 : },
252 : {
253 : // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
254 : "2.16.840.1.114404.1.1.2.4.1",
255 : "Trustwave EV OID",
256 : { 0xCE, 0xCD, 0xDC, 0x90, 0x50, 0x99, 0xD8, 0xDA, 0xDF, 0xC5, 0xB1,
257 : 0xD2, 0x09, 0xB7, 0x37, 0xCB, 0xE2, 0xC1, 0x8C, 0xFB, 0x2C, 0x10,
258 : 0xC0, 0xFF, 0x0B, 0xCF, 0x0D, 0x32, 0x86, 0xFC, 0x1A, 0xA2 },
259 : "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
260 : "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
261 : "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
262 : "UJRs7Bjq1ZxN1ZfvdY+grQ==",
263 : },
264 : {
265 : // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
266 : "2.16.840.1.114404.1.1.2.4.1",
267 : "Trustwave EV OID",
268 : { 0xF1, 0xC1, 0xB5, 0x0A, 0xE5, 0xA2, 0x0D, 0xD8, 0x03, 0x0E, 0xC9,
269 : 0xF6, 0xBC, 0x24, 0x82, 0x3D, 0xD3, 0x67, 0xB5, 0x25, 0x57, 0x59,
270 : 0xB4, 0xE7, 0x1B, 0x61, 0xFC, 0xE9, 0xF7, 0x37, 0x5D, 0x73 },
271 : "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
272 : "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
273 : "DPCOXAgWpa1Cf/DrJxhZ0A==",
274 : },
275 : {
276 : // CN=Secure Global CA,O=SecureTrust Corporation,C=US
277 : "2.16.840.1.114404.1.1.2.4.1",
278 : "Trustwave EV OID",
279 : { 0x42, 0x00, 0xF5, 0x04, 0x3A, 0xC8, 0x59, 0x0E, 0xBB, 0x52, 0x7D,
280 : 0x20, 0x9E, 0xD1, 0x50, 0x30, 0x29, 0xFB, 0xCB, 0xD4, 0x1C, 0xA1,
281 : 0xB5, 0x06, 0xEC, 0x27, 0xF1, 0x5A, 0xDE, 0x7D, 0xAC, 0x69 },
282 : "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
283 : "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
284 : "B1YipOjUiolN9BPI8PjqpQ==",
285 : },
286 : {
287 : // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
288 : "1.3.6.1.4.1.6449.1.2.1.5.1",
289 : "Comodo EV OID",
290 : { 0x17, 0x93, 0x92, 0x7A, 0x06, 0x14, 0x54, 0x97, 0x89, 0xAD, 0xCE,
291 : 0x2F, 0x8F, 0x34, 0xF7, 0xF0, 0xB6, 0x6D, 0x0F, 0x3A, 0xE3, 0xA3,
292 : 0xB8, 0x4D, 0x21, 0xEC, 0x15, 0xDB, 0xBA, 0x4F, 0xAD, 0xC7 },
293 : "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
294 : "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
295 : "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
296 : "H0evqmIAcFBUTAGem2OZKg==",
297 : },
298 : {
299 : // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
300 : "1.3.6.1.4.1.6449.1.2.1.5.1",
301 : "Comodo EV OID",
302 : { 0x0C, 0x2C, 0xD6, 0x3D, 0xF7, 0x80, 0x6F, 0xA3, 0x99, 0xED, 0xE8,
303 : 0x09, 0x11, 0x6B, 0x57, 0x5B, 0xF8, 0x79, 0x89, 0xF0, 0x65, 0x18,
304 : 0xF9, 0x80, 0x8C, 0x86, 0x05, 0x03, 0x17, 0x8B, 0xAF, 0x66 },
305 : "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
306 : "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
307 : "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
308 : "ToEtioJl4AsC7j41AkblPQ==",
309 : },
310 : {
311 : // CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
312 : "1.3.6.1.4.1.6449.1.2.1.5.1",
313 : "Comodo EV OID",
314 : { 0x68, 0x7F, 0xA4, 0x51, 0x38, 0x22, 0x78, 0xFF, 0xF0, 0xC8, 0xB1,
315 : 0x1F, 0x8D, 0x43, 0xD5, 0x76, 0x67, 0x1C, 0x6E, 0xB2, 0xBC, 0xEA,
316 : 0xB4, 0x13, 0xFB, 0x83, 0xD9, 0x65, 0xD0, 0x6D, 0x2F, 0xF2 },
317 : "MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMd"
318 : "QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0"
319 : "IEV4dGVybmFsIENBIFJvb3Q=",
320 : "AQ==",
321 : },
322 : {
323 : // CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
324 : "1.3.6.1.4.1.6449.1.2.1.5.1",
325 : "Comodo EV OID",
326 : { 0x6E, 0xA5, 0x47, 0x41, 0xD0, 0x04, 0x66, 0x7E, 0xED, 0x1B, 0x48,
327 : 0x16, 0x63, 0x4A, 0xA3, 0xA7, 0x9E, 0x6E, 0x4B, 0x96, 0x95, 0x0F,
328 : 0x82, 0x79, 0xDA, 0xFC, 0x8D, 0x9B, 0xD8, 0x81, 0x21, 0x37 },
329 : "MIGXMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
330 : "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
331 : "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEfMB0GA1UEAxMWVVROLVVTRVJGaXJz"
332 : "dC1IYXJkd2FyZQ==",
333 : "RL4Mi1AAJLQR0zYq/mUK/Q==",
334 : },
335 : {
336 : // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
337 : "2.16.840.1.114413.1.7.23.3",
338 : "Go Daddy EV OID a",
339 : { 0xC3, 0x84, 0x6B, 0xF2, 0x4B, 0x9E, 0x93, 0xCA, 0x64, 0x27, 0x4C,
340 : 0x0E, 0xC6, 0x7C, 0x1E, 0xCC, 0x5E, 0x02, 0x4F, 0xFC, 0xAC, 0xD2,
341 : 0xD7, 0x40, 0x19, 0x35, 0x0E, 0x81, 0xFE, 0x54, 0x6A, 0xE4 },
342 : "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
343 : "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
344 : "b3JpdHk=",
345 : "AA==",
346 : },
347 : {
348 : // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
349 : "2.16.840.1.114413.1.7.23.3",
350 : "Go Daddy EV OID a",
351 : { 0x45, 0x14, 0x0B, 0x32, 0x47, 0xEB, 0x9C, 0xC8, 0xC5, 0xB4, 0xF0,
352 : 0xD7, 0xB5, 0x30, 0x91, 0xF7, 0x32, 0x92, 0x08, 0x9E, 0x6E, 0x5A,
353 : 0x63, 0xE2, 0x74, 0x9D, 0xD3, 0xAC, 0xA9, 0x19, 0x8E, 0xDA },
354 : "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
355 : "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
356 : "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
357 : "AA==",
358 : },
359 : {
360 : // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
361 : "2.16.840.1.114414.1.7.23.3",
362 : "Go Daddy EV OID b",
363 : { 0x14, 0x65, 0xFA, 0x20, 0x53, 0x97, 0xB8, 0x76, 0xFA, 0xA6, 0xF0,
364 : 0xA9, 0x95, 0x8E, 0x55, 0x90, 0xE4, 0x0F, 0xCC, 0x7F, 0xAA, 0x4F,
365 : 0xB7, 0xC2, 0xC8, 0x67, 0x75, 0x21, 0xFB, 0x5F, 0xB6, 0x58 },
366 : "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
367 : "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
368 : "IEF1dGhvcml0eQ==",
369 : "AA==",
370 : },
371 : {
372 : // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
373 : "2.16.840.1.114414.1.7.23.3",
374 : "Go Daddy EV OID b",
375 : { 0x2C, 0xE1, 0xCB, 0x0B, 0xF9, 0xD2, 0xF9, 0xE1, 0x02, 0x99, 0x3F,
376 : 0xBE, 0x21, 0x51, 0x52, 0xC3, 0xB2, 0xDD, 0x0C, 0xAB, 0xDE, 0x1C,
377 : 0x68, 0xE5, 0x31, 0x9B, 0x83, 0x91, 0x54, 0xDB, 0xB7, 0xF5 },
378 : "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
379 : "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
380 : "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
381 : "RzI=",
382 : "AA==",
383 : },
384 : {
385 : // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
386 : "2.16.840.1.114412.2.1",
387 : "DigiCert EV OID",
388 : { 0x74, 0x31, 0xE5, 0xF4, 0xC3, 0xC1, 0xCE, 0x46, 0x90, 0x77, 0x4F,
389 : 0x0B, 0x61, 0xE0, 0x54, 0x40, 0x88, 0x3B, 0xA9, 0xA0, 0x1E, 0xD0,
390 : 0x0B, 0xA6, 0xAB, 0xD7, 0x80, 0x6E, 0xD3, 0xB1, 0x18, 0xCF },
391 : "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
392 : "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
393 : "bmNlIEVWIFJvb3QgQ0E=",
394 : "AqxcJmoLQJuPC3nyrkYldw==",
395 : },
396 : {
397 : // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
398 : "1.3.6.1.4.1.8024.0.2.100.1.2",
399 : "Quo Vadis EV OID",
400 : { 0x85, 0xA0, 0xDD, 0x7D, 0xD7, 0x20, 0xAD, 0xB7, 0xFF, 0x05, 0xF8,
401 : 0x3D, 0x54, 0x2B, 0x20, 0x9D, 0xC7, 0xFF, 0x45, 0x28, 0xF7, 0xD6,
402 : 0x77, 0xB1, 0x83, 0x89, 0xFE, 0xA5, 0xE5, 0xC4, 0x9E, 0x86 },
403 : "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
404 : "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
405 : "BQk=",
406 : },
407 : {
408 : // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
409 : "1.3.6.1.4.1.782.1.2.1.8.1",
410 : "Network Solutions EV OID",
411 : { 0x15, 0xF0, 0xBA, 0x00, 0xA3, 0xAC, 0x7A, 0xF3, 0xAC, 0x88, 0x4C,
412 : 0x07, 0x2B, 0x10, 0x11, 0xA0, 0x77, 0xBD, 0x77, 0xC0, 0x97, 0xF4,
413 : 0x01, 0x64, 0xB2, 0xF8, 0x59, 0x8A, 0xBD, 0x83, 0x86, 0x0C },
414 : "MGIxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhOZXR3b3JrIFNvbHV0aW9ucyBMLkwu"
415 : "Qy4xMDAuBgNVBAMTJ05ldHdvcmsgU29sdXRpb25zIENlcnRpZmljYXRlIEF1dGhv"
416 : "cml0eQ==",
417 : "V8szb8JcFuZHFhfjkDFo4A==",
418 : },
419 : {
420 : // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
421 : "2.16.840.1.114028.10.1.2",
422 : "Entrust EV OID",
423 : { 0x73, 0xC1, 0x76, 0x43, 0x4F, 0x1B, 0xC6, 0xD5, 0xAD, 0xF4, 0x5B,
424 : 0x0E, 0x76, 0xE7, 0x27, 0x28, 0x7C, 0x8D, 0xE5, 0x76, 0x16, 0xC1,
425 : 0xE6, 0xE6, 0x14, 0x1A, 0x2B, 0x2C, 0xBC, 0x7D, 0x8E, 0x4C },
426 : "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
427 : "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
428 : "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
429 : "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
430 : "RWtQVA==",
431 : },
432 : {
433 : // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
434 : "1.3.6.1.4.1.4146.1.1",
435 : "GlobalSign EV OID",
436 : { 0xEB, 0xD4, 0x10, 0x40, 0xE4, 0xBB, 0x3E, 0xC7, 0x42, 0xC9, 0xE3,
437 : 0x81, 0xD3, 0x1E, 0xF2, 0xA4, 0x1A, 0x48, 0xB6, 0x68, 0x5C, 0x96,
438 : 0xE7, 0xCE, 0xF3, 0xC1, 0xDF, 0x6C, 0xD4, 0x33, 0x1C, 0x99 },
439 : "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
440 : "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
441 : "BAAAAAABFUtaw5Q=",
442 : },
443 : {
444 : // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2
445 : "1.3.6.1.4.1.4146.1.1",
446 : "GlobalSign EV OID",
447 : { 0xCA, 0x42, 0xDD, 0x41, 0x74, 0x5F, 0xD0, 0xB8, 0x1E, 0xB9, 0x02,
448 : 0x36, 0x2C, 0xF9, 0xD8, 0xBF, 0x71, 0x9D, 0xA1, 0xBD, 0x1B, 0x1E,
449 : 0xFC, 0x94, 0x6F, 0x5B, 0x4C, 0x99, 0xF4, 0x2C, 0x1B, 0x9E },
450 : "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIyMRMwEQYDVQQKEwpH"
451 : "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
452 : "BAAAAAABD4Ym5g0=",
453 : },
454 : {
455 : // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
456 : "1.3.6.1.4.1.4146.1.1",
457 : "GlobalSign EV OID",
458 : { 0xCB, 0xB5, 0x22, 0xD7, 0xB7, 0xF1, 0x27, 0xAD, 0x6A, 0x01, 0x13,
459 : 0x86, 0x5B, 0xDF, 0x1C, 0xD4, 0x10, 0x2E, 0x7D, 0x07, 0x59, 0xAF,
460 : 0x63, 0x5A, 0x7C, 0xF4, 0x72, 0x0D, 0xC9, 0x63, 0xC5, 0x3B },
461 : "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
462 : "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
463 : "BAAAAAABIVhTCKI=",
464 : },
465 : {
466 : // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
467 : "2.16.578.1.26.1.3.3",
468 : "Buypass EV OID",
469 : { 0xED, 0xF7, 0xEB, 0xBC, 0xA2, 0x7A, 0x2A, 0x38, 0x4D, 0x38, 0x7B,
470 : 0x7D, 0x40, 0x10, 0xC6, 0x66, 0xE2, 0xED, 0xB4, 0x84, 0x3E, 0x4C,
471 : 0x29, 0xB4, 0xAE, 0x1D, 0x5B, 0x93, 0x32, 0xE6, 0xB2, 0x4D },
472 : "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
473 : "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
474 : "Ag==",
475 : },
476 : {
477 : // CN=Class 2 Primary CA,O=Certplus,C=FR
478 : "1.3.6.1.4.1.22234.2.5.2.3.1",
479 : "Certplus EV OID",
480 : { 0x0F, 0x99, 0x3C, 0x8A, 0xEF, 0x97, 0xBA, 0xAF, 0x56, 0x87, 0x14,
481 : 0x0E, 0xD5, 0x9A, 0xD1, 0x82, 0x1B, 0xB4, 0xAF, 0xAC, 0xF0, 0xAA,
482 : 0x9A, 0x58, 0xB5, 0xD5, 0x7A, 0x33, 0x8A, 0x3A, 0xFB, 0xCB },
483 : "MD0xCzAJBgNVBAYTAkZSMREwDwYDVQQKEwhDZXJ0cGx1czEbMBkGA1UEAxMSQ2xh"
484 : "c3MgMiBQcmltYXJ5IENB",
485 : "AIW9S/PY2uNp9pTXX8OlRCM=",
486 : },
487 : {
488 : // CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
489 : "1.3.6.1.4.1.17326.10.14.2.1.2",
490 : "Camerfirma EV OID a",
491 : { 0x06, 0x3E, 0x4A, 0xFA, 0xC4, 0x91, 0xDF, 0xD3, 0x32, 0xF3, 0x08,
492 : 0x9B, 0x85, 0x42, 0xE9, 0x46, 0x17, 0xD8, 0x93, 0xD7, 0xFE, 0x94,
493 : 0x4E, 0x10, 0xA7, 0x93, 0x7E, 0xE2, 0x9D, 0x96, 0x93, 0xC0 },
494 : "MIGuMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
495 : "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
496 : "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMT"
497 : "IENoYW1iZXJzIG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4",
498 : "AKPaQn6ksa7a",
499 : },
500 : {
501 : // CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
502 : "1.3.6.1.4.1.17326.10.8.12.1.2",
503 : "Camerfirma EV OID b",
504 : { 0x13, 0x63, 0x35, 0x43, 0x93, 0x34, 0xA7, 0x69, 0x80, 0x16, 0xA0,
505 : 0xD3, 0x24, 0xDE, 0x72, 0x28, 0x4E, 0x07, 0x9D, 0x7B, 0x52, 0x20,
506 : 0xBB, 0x8F, 0xBD, 0x74, 0x78, 0x16, 0xEE, 0xBE, 0xBA, 0xCA },
507 : "MIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
508 : "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
509 : "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAlBgNVBAMT"
510 : "Hkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwOA==",
511 : "AMnN0+nVfSPO",
512 : },
513 : {
514 : // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
515 : "1.3.6.1.4.1.34697.2.1",
516 : "AffirmTrust EV OID a",
517 : { 0x03, 0x76, 0xAB, 0x1D, 0x54, 0xC5, 0xF9, 0x80, 0x3C, 0xE4, 0xB2,
518 : 0xE2, 0x01, 0xA0, 0xEE, 0x7E, 0xEF, 0x7B, 0x57, 0xB6, 0x36, 0xE8,
519 : 0xA9, 0x3C, 0x9B, 0x8D, 0x48, 0x60, 0xC9, 0x6F, 0x5F, 0xA7 },
520 : "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
521 : "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
522 : "d3cGJyapsXw=",
523 : },
524 : {
525 : // CN=AffirmTrust Networking,O=AffirmTrust,C=US
526 : "1.3.6.1.4.1.34697.2.2",
527 : "AffirmTrust EV OID b",
528 : { 0x0A, 0x81, 0xEC, 0x5A, 0x92, 0x97, 0x77, 0xF1, 0x45, 0x90, 0x4A,
529 : 0xF3, 0x8D, 0x5D, 0x50, 0x9F, 0x66, 0xB5, 0xE2, 0xC5, 0x8F, 0xCD,
530 : 0xB5, 0x31, 0x05, 0x8B, 0x0E, 0x17, 0xF3, 0xF0, 0xB4, 0x1B },
531 : "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
532 : "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
533 : "fE8EORzUmS0=",
534 : },
535 : {
536 : // CN=AffirmTrust Premium,O=AffirmTrust,C=US
537 : "1.3.6.1.4.1.34697.2.3",
538 : "AffirmTrust EV OID c",
539 : { 0x70, 0xA7, 0x3F, 0x7F, 0x37, 0x6B, 0x60, 0x07, 0x42, 0x48, 0x90,
540 : 0x45, 0x34, 0xB1, 0x14, 0x82, 0xD5, 0xBF, 0x0E, 0x69, 0x8E, 0xCC,
541 : 0x49, 0x8D, 0xF5, 0x25, 0x77, 0xEB, 0xF2, 0xE9, 0x3B, 0x9A },
542 : "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
543 : "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
544 : "bYwURrGmCu4=",
545 : },
546 : {
547 : // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
548 : "1.3.6.1.4.1.34697.2.4",
549 : "AffirmTrust EV OID d",
550 : { 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64,
551 : 0x7A, 0xDD, 0x25, 0x81, 0xB0, 0x7D, 0x79, 0xAD, 0xF8, 0x39, 0x7E,
552 : 0xB4, 0xEC, 0xBA, 0x9C, 0x5E, 0x84, 0x88, 0x82, 0x14, 0x23 },
553 : "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
554 : "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
555 : "dJclisc/elQ=",
556 : },
557 : {
558 : // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
559 : "1.2.616.1.113527.2.5.1.1",
560 : "Certum EV OID",
561 : { 0x5C, 0x58, 0x46, 0x8D, 0x55, 0xF5, 0x8E, 0x49, 0x7E, 0x74, 0x39,
562 : 0x82, 0xD2, 0xB5, 0x00, 0x10, 0xB6, 0xD1, 0x65, 0x37, 0x4A, 0xCF,
563 : 0x83, 0xA7, 0xD4, 0xA3, 0x2D, 0xB7, 0x68, 0xC4, 0x40, 0x8E },
564 : "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
565 : "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
566 : "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
567 : "BETA",
568 : },
569 : {
570 : // CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
571 : "1.2.616.1.113527.2.5.1.1",
572 : "Certum EV OID",
573 : { 0xB6, 0x76, 0xF2, 0xED, 0xDA, 0xE8, 0x77, 0x5C, 0xD3, 0x6C, 0xB0,
574 : 0xF6, 0x3C, 0xD1, 0xD4, 0x60, 0x39, 0x61, 0xF4, 0x9E, 0x62, 0x65,
575 : 0xBA, 0x01, 0x3A, 0x2F, 0x03, 0x07, 0xB6, 0xD0, 0xB8, 0x04 },
576 : "MIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg"
577 : "Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQw"
578 : "IgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBIDI=",
579 : "IdbQSk8lD8kyN/yqXhKN6Q==",
580 : },
581 : {
582 : // CN=Izenpe.com,O=IZENPE S.A.,C=ES
583 : "1.3.6.1.4.1.14777.6.1.1",
584 : "Izenpe EV OID 1",
585 : { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
586 : 0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
587 : 0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
588 : "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
589 : "SXplbnBlLmNvbQ==",
590 : "ALC3WhZIX7/hy/WL1xnmfQ==",
591 : },
592 : {
593 : // CN=Izenpe.com,O=IZENPE S.A.,C=ES
594 : "1.3.6.1.4.1.14777.6.1.2",
595 : "Izenpe EV OID 2",
596 : { 0x25, 0x30, 0xCC, 0x8E, 0x98, 0x32, 0x15, 0x02, 0xBA, 0xD9, 0x6F,
597 : 0x9B, 0x1F, 0xBA, 0x1B, 0x09, 0x9E, 0x2D, 0x29, 0x9E, 0x0F, 0x45,
598 : 0x48, 0xBB, 0x91, 0x4F, 0x36, 0x3B, 0xC0, 0xD4, 0x53, 0x1F },
599 : "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
600 : "SXplbnBlLmNvbQ==",
601 : "ALC3WhZIX7/hy/WL1xnmfQ==",
602 : },
603 : {
604 : // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
605 : "1.3.6.1.4.1.7879.13.24.1",
606 : "T-Systems EV OID",
607 : { 0xFD, 0x73, 0xDA, 0xD3, 0x1C, 0x64, 0x4F, 0xF1, 0xB4, 0x3B, 0xEF,
608 : 0x0C, 0xCD, 0xDA, 0x96, 0x71, 0x0B, 0x9C, 0xD9, 0x87, 0x5E, 0xCA,
609 : 0x7E, 0x31, 0x70, 0x7A, 0xF3, 0xE9, 0x6D, 0x52, 0x2B, 0xBD },
610 : "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
611 : "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
612 : "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
613 : "AQ==",
614 : },
615 : {
616 : // CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
617 : "1.3.6.1.4.1.29836.1.10",
618 : "CNNIC EV OID",
619 : { 0x1C, 0x01, 0xC6, 0xF4, 0xDB, 0xB2, 0xFE, 0xFC, 0x22, 0x55, 0x8B,
620 : 0x2B, 0xCA, 0x32, 0x56, 0x3F, 0x49, 0x84, 0x4A, 0xCF, 0xC3, 0x2B,
621 : 0x7B, 0xE4, 0xB0, 0xFF, 0x59, 0x9F, 0x9E, 0x8C, 0x7A, 0xF7 },
622 : "MIGKMQswCQYDVQQGEwJDTjEyMDAGA1UECgwpQ2hpbmEgSW50ZXJuZXQgTmV0d29y"
623 : "ayBJbmZvcm1hdGlvbiBDZW50ZXIxRzBFBgNVBAMMPkNoaW5hIEludGVybmV0IE5l"
624 : "dHdvcmsgSW5mb3JtYXRpb24gQ2VudGVyIEVWIENlcnRpZmljYXRlcyBSb290",
625 : "SJ8AAQ==",
626 : },
627 : {
628 : // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
629 : "1.3.6.1.4.1.40869.1.1.22.3",
630 : "TWCA EV OID",
631 : { 0xBF, 0xD8, 0x8F, 0xE1, 0x10, 0x1C, 0x41, 0xAE, 0x3E, 0x80, 0x1B,
632 : 0xF8, 0xBE, 0x56, 0x35, 0x0E, 0xE9, 0xBA, 0xD1, 0xA6, 0xB9, 0xBD,
633 : 0x51, 0x5E, 0xDC, 0x5C, 0x6D, 0x5B, 0x87, 0x11, 0xAC, 0x44 },
634 : "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
635 : "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
636 : "eQ==",
637 : "AQ==",
638 : },
639 : {
640 : // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
641 : "1.3.6.1.4.1.4788.2.202.1",
642 : "D-TRUST EV OID",
643 : { 0xEE, 0xC5, 0x49, 0x6B, 0x98, 0x8C, 0xE9, 0x86, 0x25, 0xB9, 0x34,
644 : 0x09, 0x2E, 0xEC, 0x29, 0x08, 0xBE, 0xD0, 0xB0, 0xF3, 0x16, 0xC2,
645 : 0xD4, 0x73, 0x0C, 0x84, 0xEA, 0xF1, 0xF3, 0xD3, 0x48, 0x81 },
646 : "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
647 : "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
648 : "CYP0",
649 : },
650 : {
651 : // CN=VeriSign Universal Root Certification Authority,OU="(c) 2008 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
652 : "2.16.840.1.113733.1.7.23.6",
653 : "VeriSign EV OID",
654 : { 0x23, 0x99, 0x56, 0x11, 0x27, 0xA5, 0x71, 0x25, 0xDE, 0x8C, 0xEF,
655 : 0xEA, 0x61, 0x0D, 0xDF, 0x2F, 0xA0, 0x78, 0xB5, 0xC8, 0x06, 0x7F,
656 : 0x4E, 0x82, 0x82, 0x90, 0xBF, 0xB8, 0x60, 0xE8, 0x4B, 0x3C },
657 : "MIG9MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
658 : "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA4IFZl"
659 : "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxODA2BgNVBAMT"
660 : "L1ZlcmlTaWduIFVuaXZlcnNhbCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
661 : "QBrEZCGzEyEDDrvkEhrFHQ==",
662 : },
663 : {
664 : // CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
665 : "1.3.6.1.4.1.14370.1.6",
666 : "GeoTrust EV OID",
667 : { 0xB4, 0x78, 0xB8, 0x12, 0x25, 0x0D, 0xF8, 0x78, 0x63, 0x5C, 0x2A,
668 : 0xA7, 0xEC, 0x7D, 0x15, 0x5E, 0xAA, 0x62, 0x5E, 0xE8, 0x29, 0x16,
669 : 0xE2, 0xCD, 0x29, 0x43, 0x61, 0x88, 0x6C, 0xD1, 0xFB, 0xD4 },
670 : "MIGYMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjE5MDcGA1UE"
671 : "CxMwKGMpIDIwMDggR2VvVHJ1c3QgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv"
672 : "bmx5MTYwNAYDVQQDEy1HZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0"
673 : "aG9yaXR5IC0gRzM=",
674 : "FaxulBmyeUtB9iepwxgPHw==",
675 : },
676 : {
677 : // CN=thawte Primary Root CA - G3,OU="(c) 2008 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
678 : "2.16.840.1.113733.1.7.48.1",
679 : "Thawte EV OID",
680 : { 0x4B, 0x03, 0xF4, 0x58, 0x07, 0xAD, 0x70, 0xF2, 0x1B, 0xFC, 0x2C,
681 : 0xAE, 0x71, 0xC9, 0xFD, 0xE4, 0x60, 0x4C, 0x06, 0x4C, 0xF5, 0xFF,
682 : 0xB6, 0x86, 0xBA, 0xE5, 0xDB, 0xAA, 0xD7, 0xFD, 0xD3, 0x4C },
683 : "MIGuMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
684 : "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
685 : "MjAwOCB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEkMCIG"
686 : "A1UEAxMbdGhhd3RlIFByaW1hcnkgUm9vdCBDQSAtIEcz",
687 : "YAGXt0an6rS0mtZLL/eQ+w==",
688 : },
689 : {
690 : // CN = Autoridad de Certificacion Firmaprofesional CIF A62634068, C = ES
691 : "1.3.6.1.4.1.13177.10.1.3.10",
692 : "Firmaprofesional EV OID",
693 : { 0x04, 0x04, 0x80, 0x28, 0xBF, 0x1F, 0x28, 0x64, 0xD4, 0x8F, 0x9A,
694 : 0xD4, 0xD8, 0x32, 0x94, 0x36, 0x6A, 0x82, 0x88, 0x56, 0x55, 0x3F,
695 : 0x3B, 0x14, 0x30, 0x3F, 0x90, 0x14, 0x7F, 0x5D, 0x40, 0xEF },
696 : "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
697 : "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
698 : "U+w77vuySF8=",
699 : },
700 : {
701 : // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
702 : "1.3.6.1.4.1.40869.1.1.22.3",
703 : "TWCA EV OID",
704 : { 0x59, 0x76, 0x90, 0x07, 0xF7, 0x68, 0x5D, 0x0F, 0xCD, 0x50, 0x87,
705 : 0x2F, 0x9F, 0x95, 0xD5, 0x75, 0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81,
706 : 0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
707 : "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
708 : "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
709 : "DL4=",
710 : },
711 : {
712 : // CN = E-Tugra Certification Authority, OU = E-Tugra Sertifikasyon Merkezi, O = E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., L = Ankara, C = TR
713 : "2.16.792.3.0.4.1.1.4",
714 : "ETugra EV OID",
715 : { 0xB0, 0xBF, 0xD5, 0x2B, 0xB0, 0xD7, 0xD9, 0xBD, 0x92, 0xBF, 0x5D,
716 : 0x4D, 0xC1, 0x3D, 0xA2, 0x55, 0xC0, 0x2C, 0x54, 0x2F, 0x37, 0x83,
717 : 0x65, 0xEA, 0x89, 0x39, 0x11, 0xF5, 0x5E, 0x55, 0xF2, 0x3C },
718 : "MIGyMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMUAwPgYDVQQKDDdFLVR1"
719 : "xJ9yYSBFQkcgQmlsacWfaW0gVGVrbm9sb2ppbGVyaSB2ZSBIaXptZXRsZXJpIEEu"
720 : "xZ4uMSYwJAYDVQQLDB1FLVR1Z3JhIFNlcnRpZmlrYXN5b24gTWVya2V6aTEoMCYG"
721 : "A1UEAwwfRS1UdWdyYSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
722 : "amg+nFGby1M=",
723 : },
724 : {
725 : // CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
726 : "1.3.159.1.17.1",
727 : "Actalis EV OID",
728 : { 0x55, 0x92, 0x60, 0x84, 0xEC, 0x96, 0x3A, 0x64, 0xB9, 0x6E, 0x2A,
729 : 0xBE, 0x01, 0xCE, 0x0B, 0xA8, 0x6A, 0x64, 0xFB, 0xFE, 0xBC, 0xC7,
730 : 0xAA, 0xB5, 0xAF, 0xC1, 0x55, 0xB3, 0x7F, 0xD7, 0x60, 0x66 },
731 : "MGsxCzAJBgNVBAYTAklUMQ4wDAYDVQQHDAVNaWxhbjEjMCEGA1UECgwaQWN0YWxp"
732 : "cyBTLnAuQS4vMDMzNTg1MjA5NjcxJzAlBgNVBAMMHkFjdGFsaXMgQXV0aGVudGlj"
733 : "YXRpb24gUm9vdCBDQQ==",
734 : "VwoRl0LE48w=",
735 : },
736 : {
737 : // CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN
738 : "1.3.6.1.4.1.36305.2",
739 : "WoSign EV OID",
740 : { 0x4B, 0x22, 0xD5, 0xA6, 0xAE, 0xC9, 0x9F, 0x3C, 0xDB, 0x79, 0xAA,
741 : 0x5E, 0xC0, 0x68, 0x38, 0x47, 0x9C, 0xD5, 0xEC, 0xBA, 0x71, 0x64,
742 : 0xF7, 0xF2, 0x2D, 0xC1, 0xD6, 0x5F, 0x63, 0xD8, 0x57, 0x08 },
743 : "MFUxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEqMCgG"
744 : "A1UEAxMhQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgb2YgV29TaWdu",
745 : "XmjWEXGUY1BWAGjzPsnFkQ==",
746 : },
747 : {
748 : // CN=CA ...............,O=WoSign CA Limited,C=CN
749 : "1.3.6.1.4.1.36305.2",
750 : "WoSign EV OID",
751 : { 0xD6, 0xF0, 0x34, 0xBD, 0x94, 0xAA, 0x23, 0x3F, 0x02, 0x97, 0xEC,
752 : 0xA4, 0x24, 0x5B, 0x28, 0x39, 0x73, 0xE4, 0x47, 0xAA, 0x59, 0x0F,
753 : 0x31, 0x0C, 0x77, 0xF4, 0x8F, 0xDF, 0x83, 0x11, 0x22, 0x54 },
754 : "MEYxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEbMBkG"
755 : "A1UEAwwSQ0Eg5rKD6YCa5qC56K+B5Lmm",
756 : "UHBrzdgT/BtOOzNy0hFIjQ==",
757 : },
758 : {
759 : // CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
760 : "2.16.840.1.114412.2.1",
761 : "DigiCert EV OID",
762 : { 0x7D, 0x05, 0xEB, 0xB6, 0x82, 0x33, 0x9F, 0x8C, 0x94, 0x51, 0xEE,
763 : 0x09, 0x4E, 0xEB, 0xFE, 0xFA, 0x79, 0x53, 0xA1, 0x14, 0xED, 0xB2,
764 : 0xF4, 0x49, 0x49, 0x45, 0x2F, 0xAB, 0x7D, 0x2F, 0xC1, 0x85 },
765 : "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
766 : "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
767 : "Um9vdCBHMg==",
768 : "C5McOtY5Z+pnI7/Dr5r0Sw==",
769 : },
770 : {
771 : // CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
772 : "2.16.840.1.114412.2.1",
773 : "DigiCert EV OID",
774 : { 0x7E, 0x37, 0xCB, 0x8B, 0x4C, 0x47, 0x09, 0x0C, 0xAB, 0x36, 0x55,
775 : 0x1B, 0xA6, 0xF4, 0x5D, 0xB8, 0x40, 0x68, 0x0F, 0xBA, 0x16, 0x6A,
776 : 0x95, 0x2D, 0xB1, 0x00, 0x71, 0x7F, 0x43, 0x05, 0x3F, 0xC2 },
777 : "MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
778 : "EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQg"
779 : "Um9vdCBHMw==",
780 : "C6Fa+h3foLVJRK/NJKBs7A==",
781 : },
782 : {
783 : // CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
784 : "2.16.840.1.114412.2.1",
785 : "DigiCert EV OID",
786 : { 0xCB, 0x3C, 0xCB, 0xB7, 0x60, 0x31, 0xE5, 0xE0, 0x13, 0x8F, 0x8D,
787 : 0xD3, 0x9A, 0x23, 0xF9, 0xDE, 0x47, 0xFF, 0xC3, 0x5E, 0x43, 0xC1,
788 : 0x14, 0x4C, 0xEA, 0x27, 0xD4, 0x6A, 0x5A, 0xB1, 0xCB, 0x5F },
789 : "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
790 : "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
791 : "IEcy",
792 : "Azrx5qcRqaC7KGSxHQn65Q==",
793 : },
794 : {
795 : // CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
796 : "2.16.840.1.114412.2.1",
797 : "DigiCert EV OID",
798 : { 0x31, 0xAD, 0x66, 0x48, 0xF8, 0x10, 0x41, 0x38, 0xC7, 0x38, 0xF3,
799 : 0x9E, 0xA4, 0x32, 0x01, 0x33, 0x39, 0x3E, 0x3A, 0x18, 0xCC, 0x02,
800 : 0x29, 0x6E, 0xF9, 0x7C, 0x2A, 0xC9, 0xEF, 0x67, 0x31, 0xD0 },
801 : "MGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
802 : "EHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290"
803 : "IEcz",
804 : "BVVWvPJepDU1w6QP1atFcg==",
805 : },
806 : {
807 : // CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
808 : "2.16.840.1.114412.2.1",
809 : "DigiCert EV OID",
810 : { 0x55, 0x2F, 0x7B, 0xDC, 0xF1, 0xA7, 0xAF, 0x9E, 0x6C, 0xE6, 0x72,
811 : 0x01, 0x7F, 0x4F, 0x12, 0xAB, 0xF7, 0x72, 0x40, 0xC7, 0x8E, 0x76,
812 : 0x1A, 0xC2, 0x03, 0xD1, 0xD9, 0xD2, 0x0A, 0xC8, 0x99, 0x88 },
813 : "MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
814 : "EHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9v"
815 : "dCBHNA==",
816 : "BZsbV56OITLiOQe9p3d1XA==",
817 : },
818 : {
819 : // CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
820 : "1.3.6.1.4.1.8024.0.2.100.1.2",
821 : "QuoVadis EV OID",
822 : { 0x8F, 0xE4, 0xFB, 0x0A, 0xF9, 0x3A, 0x4D, 0x0D, 0x67, 0xDB, 0x0B,
823 : 0xEB, 0xB2, 0x3E, 0x37, 0xC7, 0x1B, 0xF3, 0x25, 0xDC, 0xBC, 0xDD,
824 : 0x24, 0x0E, 0xA0, 0x4D, 0xAF, 0x58, 0xB4, 0x7E, 0x18, 0x40 },
825 : "MEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMR4wHAYD"
826 : "VQQDExVRdW9WYWRpcyBSb290IENBIDIgRzM=",
827 : "RFc0JFuBiZs18s64KztbpybwdSg=",
828 : },
829 : {
830 : // CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
831 : "1.3.6.1.4.1.6449.1.2.1.5.1",
832 : "Comodo EV OID",
833 : { 0x52, 0xF0, 0xE1, 0xC4, 0xE5, 0x8E, 0xC6, 0x29, 0x29, 0x1B, 0x60,
834 : 0x31, 0x7F, 0x07, 0x46, 0x71, 0xB8, 0x5D, 0x7E, 0xA8, 0x0D, 0x5B,
835 : 0x07, 0x27, 0x34, 0x63, 0x53, 0x4B, 0x32, 0xB4, 0x02, 0x34 },
836 : "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
837 : "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
838 : "A1UEAxMiQ09NT0RPIFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
839 : "TKr5yttjb+Af907YWwOGnQ==",
840 : },
841 : {
842 : // CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
843 : "1.3.6.1.4.1.6449.1.2.1.5.1",
844 : "Comodo EV OID",
845 : { 0xE7, 0x93, 0xC9, 0xB0, 0x2F, 0xD8, 0xAA, 0x13, 0xE2, 0x1C, 0x31,
846 : 0x22, 0x8A, 0xCC, 0xB0, 0x81, 0x19, 0x64, 0x3B, 0x74, 0x9C, 0x89,
847 : 0x89, 0x64, 0xB1, 0x74, 0x6D, 0x46, 0xC3, 0xD4, 0xCB, 0xD2 },
848 : "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
849 : "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
850 : "A1UEAxMlVVNFUlRydXN0IFJTQSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
851 : "Af1tMPyjylGoG7xkDjUDLQ==",
852 : },
853 : {
854 : // CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
855 : "1.3.6.1.4.1.6449.1.2.1.5.1",
856 : "Comodo EV OID",
857 : { 0x4F, 0xF4, 0x60, 0xD5, 0x4B, 0x9C, 0x86, 0xDA, 0xBF, 0xBC, 0xFC,
858 : 0x57, 0x12, 0xE0, 0x40, 0x0D, 0x2B, 0xED, 0x3F, 0xBC, 0x4D, 0x4F,
859 : 0xBD, 0xAA, 0x86, 0xE0, 0x6A, 0xDC, 0xD2, 0xA9, 0xAD, 0x7A },
860 : "MIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxML"
861 : "SmVyc2V5IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwG"
862 : "A1UEAxMlVVNFUlRydXN0IEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
863 : "XIuZxVqUxdJxVt7NiYDMJg==",
864 : },
865 : {
866 : // CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
867 : "1.3.6.1.4.1.4146.1.1",
868 : "GlobalSign EV OID",
869 : { 0x17, 0x9F, 0xBC, 0x14, 0x8A, 0x3D, 0xD0, 0x0F, 0xD2, 0x4E, 0xA1,
870 : 0x34, 0x58, 0xCC, 0x43, 0xBF, 0xA7, 0xF5, 0x9C, 0x81, 0x82, 0xD7,
871 : 0x83, 0xA5, 0x13, 0xF6, 0xEB, 0xEC, 0x10, 0x0C, 0x89, 0x24 },
872 : "MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UE"
873 : "ChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==",
874 : "YFlJ4CYuu1X5CneKcflK2Gw=",
875 : },
876 : {
877 : // CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
878 : "2.16.840.1.114028.10.1.2",
879 : "Entrust EV OID",
880 : { 0x6D, 0xC4, 0x71, 0x72, 0xE0, 0x1C, 0xBC, 0xB0, 0xBF, 0x62, 0x58,
881 : 0x0D, 0x89, 0x5F, 0xE2, 0xB8, 0xAC, 0x9A, 0xD4, 0xF8, 0x73, 0x80,
882 : 0x1E, 0x0C, 0x10, 0xB9, 0xC8, 0x37, 0xD2, 0x1E, 0xB1, 0x77 },
883 : "MIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3LmVudHJ1c3Qu"
884 : "bmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxpYWIuKTElMCMG"
885 : "A1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UEAxMqRW50"
886 : "cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp",
887 : "OGPe+A==",
888 : },
889 : {
890 : // CN=Staat der Nederlanden EV Root CA,O=Staat der Nederlanden,C=NL
891 : "2.16.528.1.1003.1.2.7",
892 : "Staat der Nederlanden EV OID",
893 : { 0x4D, 0x24, 0x91, 0x41, 0x4C, 0xFE, 0x95, 0x67, 0x46, 0xEC, 0x4C,
894 : 0xEF, 0xA6, 0xCF, 0x6F, 0x72, 0xE2, 0x8A, 0x13, 0x29, 0x43, 0x2F,
895 : 0x9D, 0x8A, 0x90, 0x7A, 0xC4, 0xCB, 0x5D, 0xAD, 0xC1, 0x5A },
896 : "MFgxCzAJBgNVBAYTAk5MMR4wHAYDVQQKDBVTdGFhdCBkZXIgTmVkZXJsYW5kZW4x"
897 : "KTAnBgNVBAMMIFN0YWF0IGRlciBOZWRlcmxhbmRlbiBFViBSb290IENB",
898 : "AJiWjQ==",
899 : },
900 : {
901 : // CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
902 : "2.16.840.1.114028.10.1.2",
903 : "Entrust EV OID",
904 : { 0x43, 0xDF, 0x57, 0x74, 0xB0, 0x3E, 0x7F, 0xEF, 0x5F, 0xE4, 0x0D,
905 : 0x93, 0x1A, 0x7B, 0xED, 0xF1, 0xBB, 0x2E, 0x6B, 0x42, 0x73, 0x8C,
906 : 0x4E, 0x6D, 0x38, 0x41, 0x10, 0x3D, 0x3A, 0xA7, 0xF3, 0x39 },
907 : "MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
908 : "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
909 : "IDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIw"
910 : "MAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH"
911 : "Mg==",
912 : "SlOMKA==",
913 : },
914 : {
915 : // CN=Entrust Root Certification Authority - EC1,OU="(c) 2012 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
916 : "2.16.840.1.114028.10.1.2",
917 : "Entrust EV OID",
918 : { 0x02, 0xED, 0x0E, 0xB2, 0x8C, 0x14, 0xDA, 0x45, 0x16, 0x5C, 0x56,
919 : 0x67, 0x91, 0x70, 0x0D, 0x64, 0x51, 0xD7, 0xFB, 0x56, 0xF0, 0xB2,
920 : 0xAB, 0x1D, 0x3B, 0x8E, 0xB0, 0x70, 0xE5, 0x6E, 0xDF, 0xF5 },
921 : "MIG/MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UE"
922 : "CxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMp"
923 : "IDIwMTIgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTMw"
924 : "MQYDVQQDEypFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBF"
925 : "QzE=",
926 : "AKaLeSkAAAAAUNCR+Q==",
927 : },
928 : {
929 : // CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN
930 : "2.16.156.112554.3",
931 : "CFCA EV OID",
932 : { 0x5C, 0xC3, 0xD7, 0x8E, 0x4E, 0x1D, 0x5E, 0x45, 0x54, 0x7A, 0x04,
933 : 0xE6, 0x87, 0x3E, 0x64, 0xF9, 0x0C, 0xF9, 0x53, 0x6D, 0x1C, 0xCC,
934 : 0x2E, 0xF8, 0x00, 0xF3, 0x55, 0xC4, 0xC5, 0xFD, 0x70, 0xFD },
935 : "MFYxCzAJBgNVBAYTAkNOMTAwLgYDVQQKDCdDaGluYSBGaW5hbmNpYWwgQ2VydGlm"
936 : "aWNhdGlvbiBBdXRob3JpdHkxFTATBgNVBAMMDENGQ0EgRVYgUk9PVA==",
937 : "GErM1g==",
938 : },
939 : {
940 : // CN=Certification Authority of WoSign G2,O=WoSign CA Limited,C=CN
941 : "1.3.6.1.4.1.36305.2",
942 : "WoSign EV OID",
943 : { 0xD4, 0x87, 0xA5, 0x6F, 0x83, 0xB0, 0x74, 0x82, 0xE8, 0x5E, 0x96,
944 : 0x33, 0x94, 0xC1, 0xEC, 0xC2, 0xC9, 0xE5, 0x1D, 0x09, 0x03, 0xEE,
945 : 0x94, 0x6B, 0x02, 0xC3, 0x01, 0x58, 0x1E, 0xD9, 0x9E, 0x16 },
946 : "MFgxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEtMCsG"
947 : "A1UEAxMkQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgb2YgV29TaWduIEcy",
948 : "ayXaioidfLwPBbOxemFFRA==",
949 : },
950 : {
951 : // CN=CA WoSign ECC Root,O=WoSign CA Limited,C=CN
952 : "1.3.6.1.4.1.36305.2",
953 : "WoSign EV OID",
954 : { 0x8B, 0x45, 0xDA, 0x1C, 0x06, 0xF7, 0x91, 0xEB, 0x0C, 0xAB, 0xF2,
955 : 0x6B, 0xE5, 0x88, 0xF5, 0xFB, 0x23, 0x16, 0x5C, 0x2E, 0x61, 0x4B,
956 : 0xF8, 0x85, 0x56, 0x2D, 0x0D, 0xCE, 0x50, 0xB2, 0x9B, 0x02 },
957 : "MEYxCzAJBgNVBAYTAkNOMRowGAYDVQQKExFXb1NpZ24gQ0EgTGltaXRlZDEbMBkG"
958 : "A1UEAxMSQ0EgV29TaWduIEVDQyBSb290",
959 : "aEpYcIBr8I8C+vbe6LCQkA==",
960 : },
961 : {
962 : // OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP
963 : "1.2.392.200091.100.721.1",
964 : "SECOM EV OID",
965 : { 0x51, 0x3B, 0x2C, 0xEC, 0xB8, 0x10, 0xD4, 0xCD, 0xE5, 0xDD, 0x85,
966 : 0x39, 0x1A, 0xDF, 0xC6, 0xC2, 0xDD, 0x60, 0xD8, 0x7B, 0xB7, 0x36,
967 : 0xD2, 0xB5, 0x21, 0x48, 0x4A, 0xA4, 0x7A, 0x0E, 0xBE, 0xF6 },
968 : "MF0xCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
969 : "LixMVEQuMScwJQYDVQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTI=",
970 : "AA==",
971 : },
972 : {
973 : // CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
974 : "2.16.756.5.14.7.4.8",
975 : "WISeKey EV OID",
976 : { 0x6B, 0x9C, 0x08, 0xE8, 0x6E, 0xB0, 0xF7, 0x67, 0xCF, 0xAD, 0x65,
977 : 0xCD, 0x98, 0xB6, 0x21, 0x49, 0xE5, 0x49, 0x4A, 0x67, 0xF5, 0x84,
978 : 0x5E, 0x7B, 0xD1, 0xED, 0x01, 0x9F, 0x27, 0xB8, 0x6B, 0xD6 },
979 : "MG0xCzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNU"
980 : "RSBGb3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEds"
981 : "b2JhbCBSb290IEdCIENB",
982 : "drEgUnTwhYdGs/gjGvbCwA==",
983 : },
984 : {
985 : // CN=Certplus Root CA G1,O=Certplus,C=FR
986 : "1.3.6.1.4.1.22234.3.5.3.1",
987 : "DocuSign EV OID 1",
988 : { 0x15, 0x2A, 0x40, 0x2B, 0xFC, 0xDF, 0x2C, 0xD5, 0x48, 0x05, 0x4D,
989 : 0x22, 0x75, 0xB3, 0x9C, 0x7F, 0xCA, 0x3E, 0xC0, 0x97, 0x80, 0x78,
990 : 0xB0, 0xF0, 0xEA, 0x76, 0xE5, 0x61, 0xA6, 0xC7, 0x43, 0x3E },
991 : "MD4xCzAJBgNVBAYTAkZSMREwDwYDVQQKDAhDZXJ0cGx1czEcMBoGA1UEAwwTQ2Vy"
992 : "dHBsdXMgUm9vdCBDQSBHMQ==",
993 : "ESBVg+QtPlRWhS2DN7cs3EYR",
994 : },
995 : {
996 : // CN=Certplus Root CA G2,O=Certplus,C=FR
997 : "1.3.6.1.4.1.22234.3.5.3.2",
998 : "DocuSign EV OID 2",
999 : { 0x6C, 0xC0, 0x50, 0x41, 0xE6, 0x44, 0x5E, 0x74, 0x69, 0x6C, 0x4C,
1000 : 0xFB, 0xC9, 0xF8, 0x0F, 0x54, 0x3B, 0x7E, 0xAB, 0xBB, 0x44, 0xB4,
1001 : 0xCE, 0x6F, 0x78, 0x7C, 0x6A, 0x99, 0x71, 0xC4, 0x2F, 0x17 },
1002 : "MD4xCzAJBgNVBAYTAkZSMREwDwYDVQQKDAhDZXJ0cGx1czEcMBoGA1UEAwwTQ2Vy"
1003 : "dHBsdXMgUm9vdCBDQSBHMg==",
1004 : "ESDZkc6uo+jF5//pAq/Pc7xV",
1005 : },
1006 : {
1007 : // CN=OpenTrust Root CA G1,O=OpenTrust,C=FR
1008 : "1.3.6.1.4.1.22234.2.14.3.11",
1009 : "DocuSign EV OID 3",
1010 : { 0x56, 0xC7, 0x71, 0x28, 0xD9, 0x8C, 0x18, 0xD9, 0x1B, 0x4C, 0xFD,
1011 : 0xFF, 0xBC, 0x25, 0xEE, 0x91, 0x03, 0xD4, 0x75, 0x8E, 0xA2, 0xAB,
1012 : 0xAD, 0x82, 0x6A, 0x90, 0xF3, 0x45, 0x7D, 0x46, 0x0E, 0xB4 },
1013 : "MEAxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlPcGVuVHJ1c3QxHTAbBgNVBAMMFE9w"
1014 : "ZW5UcnVzdCBSb290IENBIEcx",
1015 : "ESCzkFU5fX82bWTCp59rY45n",
1016 : },
1017 : {
1018 : // CN=OpenTrust Root CA G2,O=OpenTrust,C=FR
1019 : "1.3.6.1.4.1.22234.2.14.3.11",
1020 : "DocuSign EV OID 3",
1021 : { 0x27, 0x99, 0x58, 0x29, 0xFE, 0x6A, 0x75, 0x15, 0xC1, 0xBF, 0xE8,
1022 : 0x48, 0xF9, 0xC4, 0x76, 0x1D, 0xB1, 0x6C, 0x22, 0x59, 0x29, 0x25,
1023 : 0x7B, 0xF4, 0x0D, 0x08, 0x94, 0xF2, 0x9E, 0xA8, 0xBA, 0xF2 },
1024 : "MEAxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlPcGVuVHJ1c3QxHTAbBgNVBAMMFE9w"
1025 : "ZW5UcnVzdCBSb290IENBIEcy",
1026 : "ESChaRu/vbm9UpaPI+hIvyYR",
1027 : },
1028 : {
1029 : // CN=OpenTrust Root CA G3,O=OpenTrust,C=FR
1030 : "1.3.6.1.4.1.22234.2.14.3.11",
1031 : "DocuSign EV OID 3",
1032 : { 0xB7, 0xC3, 0x62, 0x31, 0x70, 0x6E, 0x81, 0x07, 0x8C, 0x36, 0x7C,
1033 : 0xB8, 0x96, 0x19, 0x8F, 0x1E, 0x32, 0x08, 0xDD, 0x92, 0x69, 0x49,
1034 : 0xDD, 0x8F, 0x57, 0x09, 0xA4, 0x10, 0xF7, 0x5B, 0x62, 0x92 },
1035 : "MEAxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlPcGVuVHJ1c3QxHTAbBgNVBAMMFE9w"
1036 : "ZW5UcnVzdCBSb290IENBIEcz",
1037 : "ESDm+Ez8JLC+BUCs2oMbNGA/",
1038 : },
1039 : {
1040 : // CN=VeriSign Class 3 Public Primary Certification Authority - G4,OU="(c) 2007 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
1041 : "2.16.840.1.113733.1.7.23.6",
1042 : "VeriSign EV OID",
1043 : { 0x69, 0xDD, 0xD7, 0xEA, 0x90, 0xBB, 0x57, 0xC9, 0x3E, 0x13, 0x5D,
1044 : 0xC8, 0x5E, 0xA6, 0xFC, 0xD5, 0x48, 0x0B, 0x60, 0x32, 0x39, 0xBD,
1045 : 0xC4, 0x54, 0xFC, 0x75, 0x8B, 0x2A, 0x26, 0xCF, 0x7F, 0x79 },
1046 : "MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
1047 : "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA3IFZl"
1048 : "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMT"
1049 : "PFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB"
1050 : "dXRob3JpdHkgLSBHNA==",
1051 : "L4D+I4wOIg9IZxIokYessw==",
1052 : },
1053 : {
1054 : // CN=Amazon Root CA 1,O=Amazon,C=US
1055 : "2.23.140.1.1",
1056 : "CA/Browser Forum EV OID",
1057 : { 0x8E, 0xCD, 0xE6, 0x88, 0x4F, 0x3D, 0x87, 0xB1, 0x12, 0x5B, 0xA3,
1058 : 0x1A, 0xC3, 0xFC, 0xB1, 0x3D, 0x70, 0x16, 0xDE, 0x7F, 0x57, 0xCC,
1059 : 0x90, 0x4F, 0xE1, 0xCB, 0x97, 0xC6, 0xAE, 0x98, 0x19, 0x6E },
1060 : "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
1061 : "biBSb290IENBIDE=",
1062 : "Bmyfz5m/jAo54vB4ikPmljZbyg==",
1063 : },
1064 : {
1065 : // CN=Amazon Root CA 2,O=Amazon,C=US
1066 : "2.23.140.1.1",
1067 : "CA/Browser Forum EV OID",
1068 : { 0x1B, 0xA5, 0xB2, 0xAA, 0x8C, 0x65, 0x40, 0x1A, 0x82, 0x96, 0x01,
1069 : 0x18, 0xF8, 0x0B, 0xEC, 0x4F, 0x62, 0x30, 0x4D, 0x83, 0xCE, 0xC4,
1070 : 0x71, 0x3A, 0x19, 0xC3, 0x9C, 0x01, 0x1E, 0xA4, 0x6D, 0xB4 },
1071 : "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
1072 : "biBSb290IENBIDI=",
1073 : "Bmyf0pY1hp8KD+WGePhbJruKNw==",
1074 : },
1075 : {
1076 : // CN=Amazon Root CA 3,O=Amazon,C=US
1077 : "2.23.140.1.1",
1078 : "CA/Browser Forum EV OID",
1079 : { 0x18, 0xCE, 0x6C, 0xFE, 0x7B, 0xF1, 0x4E, 0x60, 0xB2, 0xE3, 0x47,
1080 : 0xB8, 0xDF, 0xE8, 0x68, 0xCB, 0x31, 0xD0, 0x2E, 0xBB, 0x3A, 0xDA,
1081 : 0x27, 0x15, 0x69, 0xF5, 0x03, 0x43, 0xB4, 0x6D, 0xB3, 0xA4 },
1082 : "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
1083 : "biBSb290IENBIDM=",
1084 : "Bmyf1XSXNmY/Owua2eiedgPySg==",
1085 : },
1086 : {
1087 : // CN=Amazon Root CA 4,O=Amazon,C=US
1088 : "2.23.140.1.1",
1089 : "CA/Browser Forum EV OID",
1090 : { 0xE3, 0x5D, 0x28, 0x41, 0x9E, 0xD0, 0x20, 0x25, 0xCF, 0xA6, 0x90,
1091 : 0x38, 0xCD, 0x62, 0x39, 0x62, 0x45, 0x8D, 0xA5, 0xC6, 0x95, 0xFB,
1092 : 0xDE, 0xA3, 0xC2, 0x2B, 0x0B, 0xFB, 0x25, 0x89, 0x70, 0x92 },
1093 : "MDkxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKEwZBbWF6b24xGTAXBgNVBAMTEEFtYXpv"
1094 : "biBSb290IENBIDQ=",
1095 : "Bmyf18G7EEwpQ+Vxe3ssyBrBDg==",
1096 : },
1097 : {
1098 : // CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
1099 : "2.23.140.1.1",
1100 : "CA/Browser Forum EV OID",
1101 : { 0x56, 0x8D, 0x69, 0x05, 0xA2, 0xC8, 0x87, 0x08, 0xA4, 0xB3, 0x02,
1102 : 0x51, 0x90, 0xED, 0xCF, 0xED, 0xB1, 0x97, 0x4A, 0x60, 0x6A, 0x13,
1103 : 0xC6, 0xE5, 0x29, 0x0F, 0xCB, 0x2A, 0xE6, 0x3E, 0xDA, 0xB5 },
1104 : "MIGYMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
1105 : "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjE7"
1106 : "MDkGA1UEAxMyU3RhcmZpZWxkIFNlcnZpY2VzIFJvb3QgQ2VydGlmaWNhdGUgQXV0"
1107 : "aG9yaXR5IC0gRzI=",
1108 : "AA==",
1109 : },
1110 : {
1111 : // CN=LuxTrust Global Root 2,O=LuxTrust S.A.,C=LU
1112 : "1.3.171.1.1.10.5.2",
1113 : "LuxTrust EV OID",
1114 : { 0x54, 0x45, 0x5F, 0x71, 0x29, 0xC2, 0x0B, 0x14, 0x47, 0xC4, 0x18,
1115 : 0xF9, 0x97, 0x16, 0x8F, 0x24, 0xC5, 0x8F, 0xC5, 0x02, 0x3B, 0xF5,
1116 : 0xDA, 0x5B, 0xE2, 0xEB, 0x6E, 0x1D, 0xD8, 0x90, 0x2E, 0xD5 },
1117 : "MEYxCzAJBgNVBAYTAkxVMRYwFAYDVQQKDA1MdXhUcnVzdCBTLkEuMR8wHQYDVQQD"
1118 : "DBZMdXhUcnVzdCBHbG9iYWwgUm9vdCAy",
1119 : "Cn6m30tEntpqJIWe5rgV0xZ/u7E=",
1120 : },
1121 : };
1122 :
1123 : static SECOidTag sEVInfoOIDTags[ArrayLength(kEVInfos)];
1124 :
1125 : static_assert(SEC_OID_UNKNOWN == 0,
1126 : "We depend on zero-initialized globals being interpreted as SEC_OID_UNKNOWN.");
1127 : static_assert(ArrayLength(sEVInfoOIDTags) == ArrayLength(kEVInfos),
1128 : "These arrays are used in parallel and must have the same length.");
1129 :
1130 : static SECOidTag
1131 86 : RegisterOID(const SECItem& oidItem, const char* oidName)
1132 : {
1133 : SECOidData od;
1134 86 : od.oid.len = oidItem.len;
1135 86 : od.oid.data = oidItem.data;
1136 86 : od.offset = SEC_OID_UNKNOWN;
1137 86 : od.desc = oidName;
1138 86 : od.mechanism = CKM_INVALID_MECHANISM;
1139 86 : od.supportedExtension = INVALID_CERT_EXTENSION;
1140 86 : return SECOID_AddEntry(&od);
1141 : }
1142 :
1143 : static SECOidTag sCABForumEVOIDTag = SEC_OID_UNKNOWN;
1144 :
1145 : static bool
1146 0 : isEVPolicy(SECOidTag policyOIDTag)
1147 : {
1148 0 : if (policyOIDTag != SEC_OID_UNKNOWN && policyOIDTag == sCABForumEVOIDTag) {
1149 0 : return true;
1150 : }
1151 :
1152 0 : for (const SECOidTag& oidTag : sEVInfoOIDTags) {
1153 0 : if (policyOIDTag == oidTag) {
1154 0 : return true;
1155 : }
1156 : }
1157 :
1158 0 : return false;
1159 : }
1160 :
1161 : bool
1162 0 : CertIsAuthoritativeForEVPolicy(const UniqueCERTCertificate& cert,
1163 : const mozilla::pkix::CertPolicyId& policy)
1164 : {
1165 0 : MOZ_ASSERT(cert);
1166 0 : if (!cert) {
1167 0 : return false;
1168 : }
1169 :
1170 : unsigned char fingerprint[SHA256_LENGTH];
1171 : SECStatus srv =
1172 0 : PK11_HashBuf(SEC_OID_SHA256, fingerprint, cert->derCert.data,
1173 0 : AssertedCast<int32_t>(cert->derCert.len));
1174 0 : if (srv != SECSuccess) {
1175 0 : return false;
1176 : }
1177 :
1178 0 : const SECOidData* cabforumOIDData = SECOID_FindOIDByTag(sCABForumEVOIDTag);
1179 0 : for (size_t i = 0; i < ArrayLength(kEVInfos); ++i) {
1180 0 : const EVInfo& entry = kEVInfos[i];
1181 :
1182 : // This check ensures that only the specific roots we approve for EV get
1183 : // that status, and not certs (roots or otherwise) that happen to have an
1184 : // OID that's already been approved for EV.
1185 0 : if (!PodEqual(fingerprint, entry.sha256Fingerprint)) {
1186 0 : continue;
1187 : }
1188 :
1189 0 : if (cabforumOIDData && cabforumOIDData->oid.len == policy.numBytes &&
1190 0 : PodEqual(cabforumOIDData->oid.data, policy.bytes, policy.numBytes)) {
1191 0 : return true;
1192 : }
1193 0 : const SECOidData* oidData = SECOID_FindOIDByTag(sEVInfoOIDTags[i]);
1194 0 : if (oidData && oidData->oid.len == policy.numBytes &&
1195 0 : PodEqual(oidData->oid.data, policy.bytes, policy.numBytes)) {
1196 0 : return true;
1197 : }
1198 : }
1199 :
1200 0 : return false;
1201 : }
1202 :
1203 : nsresult
1204 1 : LoadExtendedValidationInfo()
1205 : {
1206 : static const char* sCABForumOIDString = "2.23.140.1.1";
1207 : static const char* sCABForumOIDDescription = "CA/Browser Forum EV OID";
1208 :
1209 2 : ScopedAutoSECItem cabforumOIDItem;
1210 1 : if (SEC_StringToOID(nullptr, &cabforumOIDItem, sCABForumOIDString, 0)
1211 : != SECSuccess) {
1212 0 : return NS_ERROR_FAILURE;
1213 : }
1214 1 : sCABForumEVOIDTag = RegisterOID(cabforumOIDItem, sCABForumOIDDescription);
1215 1 : if (sCABForumEVOIDTag == SEC_OID_UNKNOWN) {
1216 0 : return NS_ERROR_FAILURE;
1217 : }
1218 :
1219 86 : for (size_t i = 0; i < ArrayLength(kEVInfos); ++i) {
1220 85 : const EVInfo& entry = kEVInfos[i];
1221 :
1222 : SECStatus srv;
1223 : #ifdef DEBUG
1224 : // This section of code double-checks that we calculated the correct
1225 : // certificate hash given the issuer and serial number and that it is
1226 : // actually present in our loaded root certificates module. It is
1227 : // unnecessary to check this in non-debug builds since we will safely fall
1228 : // back to DV if the EV information is incorrect.
1229 170 : nsAutoCString derIssuer;
1230 170 : nsresult rv = Base64Decode(nsDependentCString(entry.issuerBase64),
1231 85 : derIssuer);
1232 85 : MOZ_ASSERT(NS_SUCCEEDED(rv), "Could not base64-decode built-in EV issuer");
1233 85 : if (NS_FAILED(rv)) {
1234 0 : return rv;
1235 : }
1236 :
1237 170 : nsAutoCString serialNumber;
1238 85 : rv = Base64Decode(nsDependentCString(entry.serialBase64), serialNumber);
1239 85 : MOZ_ASSERT(NS_SUCCEEDED(rv), "Could not base64-decode built-in EV serial");
1240 85 : if (NS_FAILED(rv)) {
1241 0 : return rv;
1242 : }
1243 :
1244 : CERTIssuerAndSN ias;
1245 85 : ias.derIssuer.data =
1246 85 : BitwiseCast<unsigned char*, const char*>(derIssuer.get());
1247 85 : ias.derIssuer.len = derIssuer.Length();
1248 85 : ias.serialNumber.data =
1249 85 : BitwiseCast<unsigned char*, const char*>(serialNumber.get());
1250 85 : ias.serialNumber.len = serialNumber.Length();
1251 85 : ias.serialNumber.type = siUnsignedInteger;
1252 :
1253 170 : UniqueCERTCertificate cert(CERT_FindCertByIssuerAndSN(nullptr, &ias));
1254 :
1255 : // If an entry is missing in the NSS root database, it may be because the
1256 : // root database is out of sync with what we expect (e.g. a different
1257 : // version of system NSS is installed).
1258 85 : if (!cert) {
1259 : // The entries for the debug EV roots are at indices 0 through
1260 : // NUM_TEST_EV_ROOTS - 1. Since they're not built-in, they probably
1261 : // haven't been loaded yet.
1262 2 : MOZ_ASSERT(i < NUM_TEST_EV_ROOTS, "Could not find built-in EV root");
1263 : } else {
1264 : unsigned char certFingerprint[SHA256_LENGTH];
1265 83 : srv = PK11_HashBuf(SEC_OID_SHA256, certFingerprint, cert->derCert.data,
1266 166 : AssertedCast<int32_t>(cert->derCert.len));
1267 83 : MOZ_ASSERT(srv == SECSuccess, "Could not hash EV root");
1268 83 : if (srv != SECSuccess) {
1269 0 : return NS_ERROR_FAILURE;
1270 : }
1271 83 : bool same = PodEqual(certFingerprint, entry.sha256Fingerprint);
1272 83 : MOZ_ASSERT(same, "EV root fingerprint mismatch");
1273 83 : if (!same) {
1274 0 : return NS_ERROR_FAILURE;
1275 : }
1276 : }
1277 : #endif
1278 : // This is the code that actually enables these roots for EV.
1279 170 : ScopedAutoSECItem evOIDItem;
1280 85 : srv = SEC_StringToOID(nullptr, &evOIDItem, entry.dottedOid, 0);
1281 85 : MOZ_ASSERT(srv == SECSuccess, "SEC_StringToOID failed");
1282 85 : if (srv != SECSuccess) {
1283 0 : return NS_ERROR_FAILURE;
1284 : }
1285 85 : sEVInfoOIDTags[i] = RegisterOID(evOIDItem, entry.oidName);
1286 85 : if (sEVInfoOIDTags[i] == SEC_OID_UNKNOWN) {
1287 0 : return NS_ERROR_FAILURE;
1288 : }
1289 : }
1290 :
1291 1 : return NS_OK;
1292 : }
1293 :
1294 : // Helper function for GetFirstEVPolicy(): returns the first suitable policy
1295 : // from the given list of policies.
1296 : bool
1297 0 : GetFirstEVPolicyFromPolicyList(const UniqueCERTCertificatePolicies& policies,
1298 : /*out*/ mozilla::pkix::CertPolicyId& policy,
1299 : /*out*/ SECOidTag& policyOidTag)
1300 : {
1301 0 : for (size_t i = 0; policies->policyInfos[i]; i++) {
1302 0 : const CERTPolicyInfo* policyInfo = policies->policyInfos[i];
1303 0 : SECOidTag policyInfoOID = policyInfo->oid;
1304 0 : if (policyInfoOID == SEC_OID_UNKNOWN || !isEVPolicy(policyInfoOID)) {
1305 0 : continue;
1306 : }
1307 :
1308 0 : const SECOidData* oidData = SECOID_FindOIDByTag(policyInfoOID);
1309 0 : MOZ_ASSERT(oidData);
1310 0 : MOZ_ASSERT(oidData->oid.data);
1311 0 : MOZ_ASSERT(oidData->oid.len > 0);
1312 0 : MOZ_ASSERT(oidData->oid.len <= mozilla::pkix::CertPolicyId::MAX_BYTES);
1313 0 : if (!oidData || !oidData->oid.data || oidData->oid.len == 0 ||
1314 0 : oidData->oid.len > mozilla::pkix::CertPolicyId::MAX_BYTES) {
1315 0 : continue;
1316 : }
1317 :
1318 0 : policy.numBytes = AssertedCast<uint16_t>(oidData->oid.len);
1319 0 : PodCopy(policy.bytes, oidData->oid.data, policy.numBytes);
1320 0 : policyOidTag = policyInfoOID;
1321 0 : return true;
1322 : }
1323 :
1324 0 : return false;
1325 : }
1326 :
1327 : bool
1328 0 : GetFirstEVPolicy(CERTCertificate& cert,
1329 : /*out*/ mozilla::pkix::CertPolicyId& policy,
1330 : /*out*/ SECOidTag& policyOidTag)
1331 : {
1332 0 : if (!cert.extensions) {
1333 0 : return false;
1334 : }
1335 :
1336 0 : for (size_t i = 0; cert.extensions[i]; i++) {
1337 0 : const CERTCertExtension* extension = cert.extensions[i];
1338 0 : if (SECOID_FindOIDTag(&extension->id) != SEC_OID_X509_CERTIFICATE_POLICIES) {
1339 0 : continue;
1340 : }
1341 :
1342 : UniqueCERTCertificatePolicies policies(
1343 0 : CERT_DecodeCertificatePoliciesExtension(&extension->value));
1344 0 : if (!policies) {
1345 0 : continue;
1346 : }
1347 :
1348 0 : if (GetFirstEVPolicyFromPolicyList(policies, policy, policyOidTag)) {
1349 0 : return true;
1350 : }
1351 : }
1352 :
1353 0 : return false;
1354 : }
1355 :
1356 : } } // namespace mozilla::psm
|
