{"$schema":"https://webpki.systematicreasoning.com/schema.json","version":"1.0.0","generatedAt":"2026-07-18T08:32:52.919437+00:00","snapshotUrl":"https://webpki.systematicreasoning.com/llm_snapshot.json","slices":{"index":"https://webpki.systematicreasoning.com/llm_snapshot_index.json","governance":"https://webpki.systematicreasoning.com/llm_snapshot_governance.json","distrust":"https://webpki.systematicreasoning.com/llm_snapshot_distrust.json","market":"https://webpki.systematicreasoning.com/llm_snapshot_market.json","risk":"https://webpki.systematicreasoning.com/llm_snapshot_risk.json"},"sliceGuide":"This snapshot is ~50k tokens. For targeted analysis fetch a slice: governance (CA/Browser Forum oversight, compliance, BR readiness, audit letter quality), distrust (16 distrust events 2011-2024 + incidents), market (CA market share, trust surface), risk (geographic, government, jurisdiction, full 317-root crypto data). Each slice is self-contained with generatedAt and snapshotUrl.","dataSources":{"crtSh":"Certificate Transparency logs via crt.sh \u2014 unexpired and all-time precertificate counts per CA owner. Updated daily.","ccadb":"Common CA Database (AllCertificateRecordsCSVFormatv4) \u2014 root/intermediate metadata, trust store inclusion, CA owner details. Updated daily.","bugzilla":"Mozilla Bugzilla CA Certificate Compliance \u2014 incident reports, root program comments, CA responses. 2014-present. Updated daily.","statcounter":"StatCounter global browser market share \u2014 mapped to root programs for web coverage estimates. Updated daily.","cabforum":"CA/Browser Forum ballot records \u2014 proposers, endorsers, vote results across Server Certificate, Code Signing, S/MIME, and Network Security working groups.","keylength":"keylength.com \u2014 cryptographic key size recommendations from NIST, ECRYPT-CSA, BSI, ANSSI, and NSA CNSA.","cabforumMembers":"CA/B Forum membership roster \u2014 CA members, browser members, interested parties. Used for ecosystem participation baseline.","chromeRootStore":"Chrome Root Store git commit history \u2014 root additions and removals with timestamps.","tabIntros":"Analyst summaries generated daily by Claude Sonnet from the prior day's data digest. Each intro states the key finding for that tab with specific numbers and connects related tabs.","regulatorySurface":"Normative obligation counts across all CA compliance documents \u2014 CA/Browser Forum BRs (PDF archive 2012-2021 + GitHub tags 2021-present), root program policies, IETF RFCs (operative versions), NIS2 Directive (EUR-Lex), NIST SP 800-53 Rev 5 (OSCAL). Four convention-aware parsers: RFC2119_INLINE, SHALL_LETTERED_LIST, EU_LEGAL, NIST_OSCAL. Ballot timeline from document revision history tables."},"browserCoverage":{"chrome":0.7823,"apple":0.1639,"mozilla":0.0229,"microsoft":0.0},"market":[{"rank":1,"id":"internet-security-research-group","caSlug":"internet-security-research-group","caOwner":"Internet Security Research Group","certs":591742571,"allTimeCerts":9473786803,"share":39.7747,"turnover":16.0,"usageDays":23,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":4,"intermediateCount":13,"webCoverage":96.9,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":0.004,"selfReportPct":50,"incidentCount":40,"matched":true,"inferred":false,"parent":"","note":"All-time volume may be undercounted due to historical cross-signs (now expired) under: IdenTrust Services, LLC.","issuanceCaveat":"historical_cross_sign","crtshUrl":"https://crt.sh/?CAName=Internet%20Security%20Research%20Group"},{"rank":2,"id":"google-trust-services-llc","caSlug":"google-trust-services-llc","caOwner":"Google Trust Services LLC","certs":281388034,"allTimeCerts":2116927708,"share":18.9139,"turnover":7.5,"usageDays":49,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":12,"intermediateCount":12,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":0.018,"selfReportPct":21,"incidentCount":39,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Google%20Trust%20Services%20LLC"},{"rank":3,"id":"digicert","caSlug":"digicert","caOwner":"DigiCert","certs":203559616,"allTimeCerts":1249172818,"share":13.6825,"turnover":6.1,"usageDays":59,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":525,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":0.141,"selfReportPct":48,"incidentCount":176,"matched":true,"inferred":false,"parent":"","note":"All-time volume may be undercounted due to historical cross-signs (now expired) under: Sectigo.","issuanceCaveat":"historical_cross_sign","crtshUrl":"https://crt.sh/?CAName=DigiCert"},{"rank":4,"id":"godaddy","caSlug":"godaddy","caOwner":"GoDaddy","certs":151723226,"allTimeCerts":501614830,"share":10.1983,"turnover":3.3,"usageDays":110,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":13,"intermediateCount":21,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":0.094,"selfReportPct":57,"incidentCount":47,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=GoDaddy"},{"rank":5,"id":"sectigo","caSlug":"sectigo","caOwner":"Sectigo","certs":143435943,"allTimeCerts":1407902226,"share":9.6412,"turnover":9.8,"usageDays":37,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United Kingdom","rootCount":38,"intermediateCount":907,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":0.08,"selfReportPct":62,"incidentCount":112,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Sectigo"},{"rank":6,"id":"microsoft-corporation","caSlug":"microsoft-corporation","caOwner":"Microsoft Corporation","certs":67056190,"allTimeCerts":362273328,"share":4.5073,"turnover":5.4,"usageDays":68,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":15,"intermediateCount":14,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":true,"ppm":0.141,"selfReportPct":49,"incidentCount":51,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Microsoft Corporation may be attributed to: DigiCert.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Microsoft%20Corporation"},{"rank":7,"id":"identrust-services-llc","caSlug":"identrust-services-llc","caOwner":"IdenTrust Services, LLC","certs":16921315,"allTimeCerts":44467176,"share":1.1374,"turnover":2.6,"usageDays":139,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":29,"intermediateCount":26,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":1.732,"selfReportPct":82,"incidentCount":77,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=IdenTrust%20Services%2C%20LLC"},{"rank":8,"id":"ssl-com","caSlug":"ssl-com","caOwner":"SSL.com","certs":13065487,"allTimeCerts":108075197,"share":0.8782,"turnover":8.3,"usageDays":44,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":23,"intermediateCount":81,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":0.287,"selfReportPct":55,"incidentCount":31,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under SSL.com may be attributed to: Sectigo.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=SSL.com"},{"rank":9,"id":"amazon-trust-services","caSlug":"amazon-trust-services","caOwner":"Amazon Trust Services","certs":12732987,"allTimeCerts":18237824,"share":0.8559,"turnover":1.4,"usageDays":255,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":8,"intermediateCount":90,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":0.877,"selfReportPct":50,"incidentCount":16,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Amazon Trust Services may be attributed to: GoDaddy.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Amazon%20Trust%20Services"},{"rank":10,"id":"globalsign-nv-sa","caSlug":"globalsign-nv-sa","caOwner":"GlobalSign nv-sa","certs":1582543,"allTimeCerts":53516941,"share":0.1064,"turnover":33.8,"usageDays":11,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Belgium","rootCount":19,"intermediateCount":268,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":1.046,"selfReportPct":61,"incidentCount":56,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=GlobalSign%20nv-sa"},{"rank":11,"id":"actalis","caSlug":"actalis","caOwner":"Actalis","certs":1387517,"allTimeCerts":6897373,"share":0.0933,"turnover":5.0,"usageDays":73,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Italy","rootCount":10,"intermediateCount":17,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":3.48,"selfReportPct":62,"incidentCount":24,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Actalis"},{"rank":12,"id":"trustasia-technologies-inc","caSlug":"trustasia-technologies-inc","caOwner":"TrustAsia Technologies, Inc.","certs":944539,"allTimeCerts":1572627,"share":0.0635,"turnover":1.7,"usageDays":219,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":false},"storeCount":2,"country":"China","rootCount":12,"intermediateCount":46,"webCoverage":80.5,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":1.908,"selfReportPct":100,"incidentCount":3,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under TrustAsia Technologies, Inc. may be attributed to: Asseco Data Systems S.A..","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=TrustAsia%20Technologies%2C%20Inc."},{"rank":13,"id":"harica","caSlug":"harica","caOwner":"HARICA","certs":720077,"allTimeCerts":850319,"share":0.0484,"turnover":1.2,"usageDays":309,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Greece","rootCount":9,"intermediateCount":93,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":22.345,"selfReportPct":58,"incidentCount":19,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=HARICA"},{"rank":14,"id":"asseco-data-systems-s-a","caSlug":"asseco-data-systems-s-a","caOwner":"Asseco Data Systems S.A.","certs":692738,"allTimeCerts":6142930,"share":0.0466,"turnover":8.9,"usageDays":41,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Poland","rootCount":14,"intermediateCount":98,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":8.139,"selfReportPct":54,"incidentCount":50,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Asseco%20Data%20Systems%20S.A."},{"rank":15,"id":"certainly-llc","caSlug":"certainly-llc","caOwner":"Certainly LLC","certs":140922,"allTimeCerts":13753944,"share":0.0095,"turnover":97.6,"usageDays":4,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":true},"storeCount":3,"country":"United States","rootCount":2,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":0.8,"selfReportPct":27,"incidentCount":11,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Certainly%20LLC"},{"rank":18,"id":"d-trust","caSlug":"d-trust","caOwner":"D-Trust","certs":67735,"allTimeCerts":172951,"share":0.0046,"turnover":2.6,"usageDays":143,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":12,"intermediateCount":41,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=D-Trust"},{"rank":19,"id":"taiwan-ca-inc-twca","caSlug":"taiwan-ca-inc-twca","caOwner":"Taiwan-CA Inc. (TWCA)","certs":55000,"allTimeCerts":366047,"share":0.0037,"turnover":6.7,"usageDays":55,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Taiwan (Republic of China)","rootCount":5,"intermediateCount":15,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":40.978,"selfReportPct":60,"incidentCount":15,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Taiwan-CA%20Inc.%20%28TWCA%29"},{"rank":20,"id":"swisssign-ag","caSlug":"swisssign-ag","caOwner":"SwissSign AG","certs":50055,"allTimeCerts":187072,"share":0.0034,"turnover":3.7,"usageDays":98,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Switzerland","rootCount":8,"intermediateCount":3,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":347.46,"selfReportPct":77,"incidentCount":65,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=SwissSign%20AG"},{"rank":21,"id":"secom-trust-systems-co-ltd","caSlug":"secom-trust-systems-co-ltd","caOwner":"SECOM Trust Systems Co., Ltd.","certs":39940,"allTimeCerts":500000,"share":0.0027,"turnover":12.5,"usageDays":29,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Japan","rootCount":12,"intermediateCount":37,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=SECOM%20Trust%20Systems%20Co.%2C%20Ltd."},{"rank":22,"id":"telia-company","caSlug":"telia-company","caOwner":"Telia Company","certs":35340,"allTimeCerts":141545,"share":0.0024,"turnover":4.0,"usageDays":91,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Sweden","rootCount":12,"intermediateCount":28,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":261.401,"selfReportPct":68,"incidentCount":37,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Telia%20Company"},{"rank":23,"id":"cybertrust-japan-co-ltd","caSlug":"cybertrust-japan-co-ltd","caOwner":"Cybertrust Japan Co., Ltd.","certs":34358,"allTimeCerts":212058,"share":0.0023,"turnover":6.2,"usageDays":59,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Japan","rootCount":13,"intermediateCount":6,"webCoverage":2.3,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":14.147,"selfReportPct":33,"incidentCount":3,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Cybertrust%20Japan%20Co.%2C%20Ltd."},{"rank":24,"id":"shanghai-electronic-certification-authority-co-ltd","caSlug":"shanghai-electronic-certification-authority-co-ltd","caOwner":"Shanghai Electronic Certification Authority Co., Ltd.","certs":30500,"allTimeCerts":68423,"share":0.0021,"turnover":2.2,"usageDays":163,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"China","rootCount":12,"intermediateCount":60,"webCoverage":80.5,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":394.604,"selfReportPct":70,"incidentCount":27,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Shanghai Electronic Certification Authority Co., Ltd. may be attributed to: Asseco Data Systems S.A..","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Shanghai%20Electronic%20Certification%20Authority%20Co.%2C%20Ltd."},{"rank":25,"id":"emudhra-technologies-limited","caSlug":"emudhra-technologies-limited","caOwner":"eMudhra Technologies Limited","certs":26131,"allTimeCerts":55042,"share":0.0018,"turnover":2.1,"usageDays":173,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"India","rootCount":16,"intermediateCount":72,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":381.527,"selfReportPct":81,"incidentCount":21,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=eMudhra%20Technologies%20Limited"},{"rank":27,"id":"deutsche-telekom-security-gmbh","caSlug":"deutsche-telekom-security-gmbh","caOwner":"Deutsche Telekom Security GmbH","certs":20300,"allTimeCerts":125650,"share":0.0014,"turnover":6.2,"usageDays":59,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":7,"intermediateCount":37,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":230.8,"selfReportPct":48,"incidentCount":29,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Deutsche%20Telekom%20Security%20GmbH"},{"rank":28,"id":"naver-cloud-trust-services","caSlug":"naver-cloud-trust-services","caOwner":"NAVER Cloud Trust Services","certs":8914,"allTimeCerts":24193,"share":0.0006,"turnover":2.7,"usageDays":134,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Republic of Korea (South Korea)","rootCount":3,"intermediateCount":7,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":413.343,"selfReportPct":70,"incidentCount":10,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=NAVER%20Cloud%20Trust%20Services"},{"rank":29,"id":"china-financial-certification-authority-cfca","caSlug":"china-financial-certification-authority-cfca","caOwner":"China Financial Certification Authority (CFCA)","certs":5188,"allTimeCerts":28064,"share":0.0003,"turnover":5.4,"usageDays":67,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"China","rootCount":9,"intermediateCount":5,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":1175.884,"selfReportPct":48,"incidentCount":33,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=China%20Financial%20Certification%20Authority%20%28CFCA%29"},{"rank":30,"id":"oiste","caSlug":"oiste","caOwner":"OISTE","certs":4455,"allTimeCerts":4685,"share":0.0003,"turnover":1.1,"usageDays":347,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Switzerland","rootCount":7,"intermediateCount":19,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=OISTE"},{"rank":31,"id":"certsign","caSlug":"certsign","caOwner":"certSIGN","certs":4046,"allTimeCerts":19391,"share":0.0003,"turnover":4.8,"usageDays":76,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Romania","rootCount":3,"intermediateCount":5,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":1186.117,"selfReportPct":74,"incidentCount":23,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=certSIGN"},{"rank":32,"id":"government-of-spain-f-brica-nacional-de-moneda-y-timbre-fnmt","caSlug":"government-of-spain-f-brica-nacional-de-moneda-y-timbre-fnmt","caOwner":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","certs":2940,"allTimeCerts":16759,"share":0.0002,"turnover":5.7,"usageDays":64,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":7,"intermediateCount":11,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":1133.719,"selfReportPct":79,"incidentCount":19,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20F%C3%A1brica%20Nacional%20de%20Moneda%20y%20Timbre%20%28FNMT%29"},{"rank":33,"id":"government-of-hong-kong-sar-hongkong-post-certizen","caSlug":"government-of-hong-kong-sar-hongkong-post-certizen","caOwner":"Government of Hong Kong (SAR), Hongkong Post, Certizen","certs":2927,"allTimeCerts":16898,"share":0.0002,"turnover":5.8,"usageDays":63,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"China","rootCount":4,"intermediateCount":6,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":473.429,"selfReportPct":88,"incidentCount":8,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Government of Hong Kong (SAR), Hongkong Post, Certizen may be attributed to: GlobalSign nv-sa.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Hong%20Kong%20%28SAR%29%2C%20Hongkong%20Post%2C%20Certizen"},{"rank":34,"id":"microsec-ltd","caSlug":"microsec-ltd","caOwner":"Microsec Ltd.","certs":2925,"allTimeCerts":12100,"share":0.0002,"turnover":4.1,"usageDays":88,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Hungary","rootCount":13,"intermediateCount":48,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":true,"ppm":1404.959,"selfReportPct":65,"incidentCount":17,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Microsec%20Ltd."},{"rank":35,"id":"government-of-spain-autoritat-de-certificaci-de-la-comunitat-valenciana-accv","caSlug":"government-of-spain-autoritat-de-certificaci-de-la-comunitat-valenciana-accv","caOwner":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","certs":2719,"allTimeCerts":17695,"share":0.0002,"turnover":6.5,"usageDays":56,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":6,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":395.592,"selfReportPct":71,"incidentCount":7,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20Autoritat%20de%20Certificaci%C3%B3%20de%20la%20Comunitat%20Valenciana%20%28ACCV%29"},{"rank":36,"id":"open-access-technology-international-inc-oati","caSlug":"open-access-technology-international-inc-oati","caOwner":"Open Access Technology International, Inc. (OATI)","certs":2471,"allTimeCerts":12266,"share":0.0002,"turnover":5.0,"usageDays":74,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"United States","rootCount":3,"intermediateCount":4,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Open%20Access%20Technology%20International%2C%20Inc.%20%28OATI%29"},{"rank":37,"id":"government-of-finland-population-register-centre-s-v-est-rekisterikeskus-vrk","caSlug":"government-of-finland-population-register-centre-s-v-est-rekisterikeskus-vrk","caOwner":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","certs":2366,"allTimeCerts":13874,"share":0.0002,"turnover":5.9,"usageDays":62,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Finland","rootCount":4,"intermediateCount":4,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Finland%2C%20Population%20Register%20Centre%E2%80%99s%20%28V%C3%A4est%C3%B6rekisterikeskus%2C%20VRK%29"},{"rank":38,"id":"wisekey","caSlug":"wisekey","caOwner":"WISeKey","certs":1876,"allTimeCerts":16243,"share":0.0001,"turnover":8.7,"usageDays":42,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Switzerland","rootCount":7,"intermediateCount":19,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":985.04,"selfReportPct":69,"incidentCount":16,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=WISeKey"},{"rank":39,"id":"certigna","caSlug":"certigna","caOwner":"Certigna","certs":1854,"allTimeCerts":79064,"share":0.0001,"turnover":42.6,"usageDays":9,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"France","rootCount":6,"intermediateCount":10,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":379.439,"selfReportPct":47,"incidentCount":30,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Certigna"},{"rank":40,"id":"buypass","caSlug":"buypass","caOwner":"Buypass","certs":1510,"allTimeCerts":1293950,"share":0.0001,"turnover":856.9,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Norway","rootCount":5,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":12.365,"selfReportPct":88,"incidentCount":16,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Buypass"},{"rank":41,"id":"autoridad-de-certificacion-firmaprofesional","caSlug":"autoridad-de-certificacion-firmaprofesional","caOwner":"Autoridad de Certificacion Firmaprofesional","certs":1480,"allTimeCerts":10623,"share":0.0001,"turnover":7.2,"usageDays":51,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":4,"intermediateCount":7,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":3859.55,"selfReportPct":68,"incidentCount":41,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificacion%20Firmaprofesional"},{"rank":42,"id":"atos","caSlug":"atos","caOwner":"Atos","certs":1117,"allTimeCerts":18436,"share":0.0001,"turnover":16.5,"usageDays":22,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":5,"intermediateCount":24,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Atos"},{"rank":43,"id":"izenpe-s-a","caSlug":"izenpe-s-a","caOwner":"Izenpe S.A.","certs":1094,"allTimeCerts":7571,"share":0.0001,"turnover":6.9,"usageDays":53,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":5,"intermediateCount":6,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":3037.908,"selfReportPct":57,"incidentCount":23,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Izenpe%20S.A."},{"rank":44,"id":"postsignum","caSlug":"postsignum","caOwner":"PostSignum","certs":991,"allTimeCerts":5642,"share":0.0001,"turnover":5.7,"usageDays":64,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Czechia","rootCount":3,"intermediateCount":2,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":354.484,"selfReportPct":100,"incidentCount":2,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=PostSignum"},{"rank":45,"id":"global-digital-cybersecurity-authority-co-ltd-formerly-guang-dong-certificate-authority-gdca","caSlug":"global-digital-cybersecurity-authority-co-ltd-formerly-guang-dong-certificate-authority-gdca","caOwner":"Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA))","certs":888,"allTimeCerts":6225,"share":0.0001,"turnover":7.0,"usageDays":52,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"China","rootCount":1,"intermediateCount":3,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":1445.783,"selfReportPct":78,"incidentCount":9,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Global%20Digital%20Cybersecurity%20Authority%20Co.%2C%20Ltd.%20%28Formerly%20Guang%20Dong%20Certificate%20Authority%20%28GDCA%29%29"},{"rank":46,"id":"government-of-brazil-instituto-nacional-de-tecnologia-da-informa-o-iti","caSlug":"government-of-brazil-instituto-nacional-de-tecnologia-da-informa-o-iti","caOwner":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","certs":509,"allTimeCerts":7437,"share":0.0,"turnover":14.6,"usageDays":25,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Brazil","rootCount":6,"intermediateCount":5,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Brazil%2C%20Instituto%20Nacional%20de%20Tecnologia%20da%20Informa%C3%A7%C3%A3o%20%28ITI%29"},{"rank":47,"id":"krajowa-izba-rozliczeniowa-s-a-kir","caSlug":"krajowa-izba-rozliczeniowa-s-a-kir","caOwner":"Krajowa Izba Rozliczeniowa S.A. (KIR)","certs":453,"allTimeCerts":3115,"share":0.0,"turnover":6.9,"usageDays":53,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"Poland","rootCount":5,"intermediateCount":2,"webCoverage":80.5,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":6420.546,"selfReportPct":0,"incidentCount":20,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Krajowa%20Izba%20Rozliczeniowa%20S.A.%20%28KIR%29"},{"rank":48,"id":"disig-a-s","caSlug":"disig-a-s","caOwner":"Disig, a.s.","certs":379,"allTimeCerts":1702,"share":0.0,"turnover":4.5,"usageDays":81,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Slovakia","rootCount":5,"intermediateCount":5,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":6462.985,"selfReportPct":55,"incidentCount":11,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Disig%2C%20a.s."},{"rank":49,"id":"prvn-certifika-n-autorita-a-s","caSlug":"prvn-certifika-n-autorita-a-s","caOwner":"Prvn\u00ed certifika\u010dn\u00ed autorita, a.s.","certs":352,"allTimeCerts":2396,"share":0.0,"turnover":6.8,"usageDays":54,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Czechia","rootCount":9,"intermediateCount":12,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Prvn%C3%AD%20certifika%C4%8Dn%C3%AD%20autorita%2C%20a.s."},{"rank":50,"id":"financijska-agencija-fina","caSlug":"financijska-agencija-fina","caOwner":"Financijska agencija (Fina)","certs":307,"allTimeCerts":1954,"share":0.0,"turnover":6.4,"usageDays":57,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Croatia","rootCount":1,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Financijska%20agencija%20%28Fina%29"},{"rank":51,"id":"government-of-india-ministry-of-communications-information-technology-controller-of-certifying-authorities-cca","caSlug":"government-of-india-ministry-of-communications-information-technology-controller-of-certifying-authorities-cca","caOwner":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","certs":214,"allTimeCerts":936,"share":0.0,"turnover":4.4,"usageDays":83,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"India","rootCount":6,"intermediateCount":1,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20India%2C%20Ministry%20of%20Communications%20%26%20Information%20Technology%2C%20Controller%20of%20Certifying%20Authorities%20%28CCA%29"},{"rank":53,"id":"chunghwa-telecom","caSlug":"chunghwa-telecom","caOwner":"Chunghwa Telecom","certs":153,"allTimeCerts":41741,"share":0.0,"turnover":272.8,"usageDays":1,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Taiwan, Republic of China","rootCount":6,"intermediateCount":4,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":694.761,"selfReportPct":72,"incidentCount":29,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Chunghwa%20Telecom"},{"rank":54,"id":"a-trust","caSlug":"a-trust","caOwner":"A-Trust","certs":147,"allTimeCerts":441,"share":0.0,"turnover":3.0,"usageDays":122,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Austria","rootCount":11,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=A-Trust"},{"rank":55,"id":"government-of-turkey-kamu-sertifikasyon-merkezi-kamu-sm","caSlug":"government-of-turkey-kamu-sertifikasyon-merkezi-kamu-sm","caOwner":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","certs":144,"allTimeCerts":973,"share":0.0,"turnover":6.8,"usageDays":54,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Turkey","rootCount":3,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":4110.997,"selfReportPct":25,"incidentCount":4,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Turkey%2C%20Kamu%20Sertifikasyon%20Merkezi%20%28Kamu%20SM%29"},{"rank":56,"id":"visa","caSlug":"visa","caOwner":"Visa","certs":110,"allTimeCerts":436,"share":0.0,"turnover":4.0,"usageDays":92,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"United States","rootCount":5,"intermediateCount":3,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":6880.734,"selfReportPct":0,"incidentCount":3,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Visa"},{"rank":57,"id":"agence-nationale-de-certification-electronique","caSlug":"agence-nationale-de-certification-electronique","caOwner":"Agence Nationale de Certification Electronique","certs":77,"allTimeCerts":842,"share":0.0,"turnover":10.9,"usageDays":33,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"Tunisia","rootCount":3,"intermediateCount":2,"webCoverage":80.5,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":5938.242,"selfReportPct":80,"incidentCount":5,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Agence%20Nationale%20de%20Certification%20Electronique"},{"rank":58,"id":"edicom","caSlug":"edicom","caOwner":"EDICOM","certs":43,"allTimeCerts":347,"share":0.0,"turnover":8.1,"usageDays":45,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":2,"intermediateCount":1,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=EDICOM"},{"rank":59,"id":"government-of-korea-klid","caSlug":"government-of-korea-klid","caOwner":"Government of Korea, KLID","certs":38,"allTimeCerts":8656,"share":0.0,"turnover":227.8,"usageDays":2,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Republic of Korea (South Korea)","rootCount":5,"intermediateCount":1,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Korea%2C%20KLID"},{"rank":60,"id":"netlock","caSlug":"netlock","caOwner":"Netlock","certs":13,"allTimeCerts":20091,"share":0.0,"turnover":1545.5,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"Hungary","rootCount":13,"intermediateCount":15,"webCoverage":80.5,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":2040.715,"selfReportPct":61,"incidentCount":41,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Netlock"},{"rank":61,"id":"autoridad-de-certificaci-n-anf-ac","caSlug":"autoridad-de-certificaci-n-anf-ac","caOwner":"Autoridad de Certificaci\u00f3n (ANF AC)","certs":13,"allTimeCerts":45,"share":0.0,"turnover":3.5,"usageDays":105,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":false},"storeCount":2,"country":"Spain","rootCount":5,"intermediateCount":1,"webCoverage":80.5,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":288888.889,"selfReportPct":92,"incidentCount":13,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificaci%C3%B3n%20%28ANF%20AC%29"},{"rank":62,"id":"itruschina-co-ltd","caSlug":"itruschina-co-ltd","caOwner":"iTrusChina Co., Ltd.","certs":12,"allTimeCerts":64,"share":0.0,"turnover":5.3,"usageDays":68,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":false},"storeCount":2,"country":"China","rootCount":2,"intermediateCount":8,"webCoverage":80.5,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=iTrusChina%20Co.%2C%20Ltd."},{"rank":64,"id":"beijing-certificate-authority-co-ltd","caSlug":"beijing-certificate-authority-co-ltd","caOwner":"BEIJING CERTIFICATE AUTHORITY Co., Ltd.","certs":9,"allTimeCerts":80,"share":0.0,"turnover":8.9,"usageDays":41,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":false,"apple":false},"storeCount":1,"country":"China","rootCount":6,"intermediateCount":17,"webCoverage":2.3,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=BEIJING%20CERTIFICATE%20AUTHORITY%20Co.%2C%20Ltd."},{"rank":65,"id":"cybertrust-japan-jcsi","caSlug":"cybertrust-japan-jcsi","caOwner":"Cybertrust Japan / JCSI","certs":2,"allTimeCerts":2,"share":0.0,"turnover":1.0,"usageDays":365,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Japan","rootCount":13,"intermediateCount":6,"webCoverage":2.3,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Cybertrust%20Japan%20/%20JCSI"},{"rank":79,"id":"verizon-terremark-nv","caSlug":"verizon-terremark-nv","caOwner":"Verizon Terremark NV","certs":0,"allTimeCerts":6891,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":525,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Verizon%20Terremark%20NV"},{"rank":80,"id":"verizon","caSlug":"verizon","caOwner":"Verizon","certs":0,"allTimeCerts":5,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":525,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Verizon"},{"rank":81,"id":"ac-camerfirma-s-a","caSlug":"ac-camerfirma-s-a","caOwner":"AC Camerfirma, S.A.","certs":0,"allTimeCerts":6766,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":7,"intermediateCount":12,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=AC%20Camerfirma%2C%20S.A."},{"rank":82,"id":"quovadis-trustlink-b-v","caSlug":"quovadis-trustlink-b-v","caOwner":"QuoVadis Trustlink B.V.","certs":0,"allTimeCerts":18282,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":525,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=QuoVadis%20Trustlink%20B.V."},{"rank":83,"id":"t-systems-international-gmbh","caSlug":"t-systems-international-gmbh","caOwner":"T-Systems International GmbH","certs":0,"allTimeCerts":4,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":7,"intermediateCount":37,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=T-Systems%20International%20GmbH"},{"rank":90,"id":"consorci-administraci-oberta-de-catalunya-consorci-aoc-catcert","caSlug":"consorci-administraci-oberta-de-catalunya-consorci-aoc-catcert","caOwner":"Consorci Administraci\u00f3 Oberta de Catalunya (Consorci AOC, CATCert)","certs":0,"allTimeCerts":2831,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":1,"intermediateCount":4,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Consorci%20Administraci%C3%B3%20Oberta%20de%20Catalunya%20%28Consorci%20AOC%2C%20CATCert%29"},{"rank":91,"id":"multicert","caSlug":"multicert","caOwner":"MULTICERT","certs":0,"allTimeCerts":4197,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Portugal","rootCount":1,"intermediateCount":4,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=MULTICERT"},{"rank":92,"id":"swiss-bit-swiss-federal-office-of-information-technology-systems-and-telecommunication-foitt","caSlug":"swiss-bit-swiss-federal-office-of-information-technology-systems-and-telecommunication-foitt","caOwner":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Switzerland","rootCount":6,"intermediateCount":0,"webCoverage":0.0,"tls":false,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Swiss%20BIT%2C%20Swiss%20Federal%20Office%20of%20Information%20Technology%2C%20Systems%20and%20Telecommunication%20%28FOITT%29"},{"rank":93,"id":"government-of-the-netherlands-pkioverheid-logius","caSlug":"government-of-the-netherlands-pkioverheid-logius","caOwner":"Government of The Netherlands, PKIoverheid (Logius)","certs":0,"allTimeCerts":4,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Netherlands","rootCount":5,"intermediateCount":8,"webCoverage":2.3,"tls":false,"ev":true,"smime":true,"codeSigning":false,"ppm":11250000.0,"selfReportPct":71,"incidentCount":45,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20The%20Netherlands%2C%20PKIoverheid%20%28Logius%29"},{"rank":95,"id":"si-trust","caSlug":"si-trust","caOwner":"SI-TRUST","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Slovenia","rootCount":3,"intermediateCount":3,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=SI-TRUST"},{"rank":99,"id":"docaposte-certinomis-sas","caSlug":"docaposte-certinomis-sas","caOwner":"Docaposte Certinomis SAS","certs":0,"allTimeCerts":1375,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"France","rootCount":2,"intermediateCount":7,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Docaposte%20Certinomis%20SAS"},{"rank":100,"id":"quo-vadis-trustlink-b-v","caSlug":"quo-vadis-trustlink-b-v","caOwner":"Quo Vadis Trustlink B.V.","certs":0,"allTimeCerts":15515,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":525,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Quo%20Vadis%20Trustlink%20B.V."},{"rank":108,"id":"government-of-japan-digital-agency","caSlug":"government-of-japan-digital-agency","caOwner":"Government of Japan, Digital Agency","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Japan","rootCount":3,"intermediateCount":2,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Japan%2C%20Digital%20Agency"},{"rank":109,"id":"e-commerce-monitoring-gmbh","caSlug":"e-commerce-monitoring-gmbh","caOwner":"e-commerce monitoring GmbH","certs":0,"allTimeCerts":246,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Austria","rootCount":5,"intermediateCount":34,"webCoverage":0.0,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=e-commerce%20monitoring%20GmbH"},{"rank":123,"id":"halcom-d-d","caSlug":"halcom-d-d","caOwner":"Halcom D.D.","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Slovenia","rootCount":4,"intermediateCount":8,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Halcom%20D.D."},{"rank":125,"id":"consejo-general-de-la-abogac-a-espa-ola","caSlug":"consejo-general-de-la-abogac-a-espa-ola","caOwner":"Consejo General de la Abogac\u00eda Espa\u00f1ola","certs":0,"allTimeCerts":4,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":2,"intermediateCount":3,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Consejo%20General%20de%20la%20Abogac%C3%ADa%20Espa%C3%B1ola"},{"rank":130,"id":"comsign","caSlug":"comsign","caOwner":"ComSign","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Israel","rootCount":4,"intermediateCount":6,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=ComSign"},{"rank":134,"id":"netrust-pte-ltd","caSlug":"netrust-pte-ltd","caOwner":"Netrust Pte Ltd","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Singapore","rootCount":2,"intermediateCount":2,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Netrust%20Pte%20Ltd"},{"rank":146,"id":"government-of-sweden-f-rs-kringskassan","caSlug":"government-of-sweden-f-rs-kringskassan","caOwner":"Government of Sweden (F\u00f6rs\u00e4kringskassan)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Sweden","rootCount":3,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Sweden%20%28F%C3%B6rs%C3%A4kringskassan%29"},{"rank":150,"id":"department-of-defence-australia","caSlug":"department-of-defence-australia","caOwner":"Department of Defence Australia","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Australia","rootCount":2,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Department%20of%20Defence%20Australia"},{"rank":156,"id":"carillon-information-security-inc","caSlug":"carillon-information-security-inc","caOwner":"Carillon Information Security Inc.","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Canada","rootCount":2,"intermediateCount":0,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Carillon%20Information%20Security%20Inc."},{"rank":158,"id":"macao-post-and-telecommunications-bureau","caSlug":"macao-post-and-telecommunications-bureau","caOwner":"Macao Post and Telecommunications Bureau","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"China","rootCount":3,"intermediateCount":7,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Macao%20Post%20and%20Telecommunications%20Bureau"},{"rank":165,"id":"trustfactory-pty-ltd","caSlug":"trustfactory-pty-ltd","caOwner":"TrustFactory(Pty)Ltd","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"South Africa","rootCount":2,"intermediateCount":1,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=TrustFactory%28Pty%29Ltd"},{"rank":167,"id":"lawtrust","caSlug":"lawtrust","caOwner":"LAWtrust","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"South Africa","rootCount":3,"intermediateCount":6,"webCoverage":2.3,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=LAWtrust"},{"rank":169,"id":"zetes","caSlug":"zetes","caOwner":"Zetes","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Belgium","rootCount":1,"intermediateCount":2,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Zetes"},{"rank":172,"id":"saudi-data-and-artificial-intelligence-authority-sdaia","caSlug":"saudi-data-and-artificial-intelligence-authority-sdaia","caOwner":"Saudi Data and Artificial Intelligence Authority (SDAIA)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Saudi Arabia","rootCount":2,"intermediateCount":5,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Saudi%20Data%20and%20Artificial%20Intelligence%20Authority%20%28SDAIA%29"},{"rank":176,"id":"thailand-national-root-certificate-authority-electronic-transactions-development-agency","caSlug":"thailand-national-root-certificate-authority-electronic-transactions-development-agency","caOwner":"Thailand National Root Certificate Authority (Electronic Transactions Development Agency)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Thailand","rootCount":3,"intermediateCount":5,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Thailand%20National%20Root%20Certificate%20Authority%20%28Electronic%20Transactions%20Development%20Agency%29"},{"rank":181,"id":"digitalsign-certificadora-digital-s-a","caSlug":"digitalsign-certificadora-digital-s-a","caOwner":"DigitalSign - Certificadora Digital, S.A.","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":false,"apple":false},"storeCount":1,"country":"Portugal","rootCount":2,"intermediateCount":8,"webCoverage":2.3,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=DigitalSign%20-%20Certificadora%20Digital%2C%20S.A."},{"rank":192,"id":"notarius","caSlug":"notarius","caOwner":"Notarius","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Canada","rootCount":2,"intermediateCount":3,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Notarius"}],"concentration":{"hhi":2347,"hhiLabel":"moderately concentrated","cr3":72.37,"cr5":92.21,"cr7":97.86,"headCount":21,"headPct":99.9762,"tailCount":68,"tailPct":0.0238},"trustSurface":{"totalRoots":355,"totalOwners":83,"allFourStores":{"roots":76,"owners":37},"perStore":{"Mozilla":{"roots":171,"owners":50},"Microsoft":{"roots":331,"owners":77},"Chrome":{"roots":105,"owners":45},"Apple":{"roots":144,"owners":39}},"rootCombinations":[{"stores":["Microsoft"],"count":158},{"stores":["Apple","Chrome","Microsoft","Mozilla"],"count":76},{"stores":["Apple","Microsoft","Mozilla"],"count":39},{"stores":["Apple","Microsoft"],"count":21},{"stores":["Chrome","Microsoft","Mozilla"],"count":19},{"stores":["Microsoft","Mozilla"],"count":17},{"stores":["Mozilla"],"count":10},{"stores":["Chrome","Mozilla"],"count":7},{"stores":["Apple"],"count":4},{"stores":["Apple","Chrome","Mozilla"],"count":2},{"stores":["Apple","Chrome","Microsoft"],"count":1},{"stores":["Apple","Mozilla"],"count":1}],"ownerCombinations":[{"stores":["Apple","Chrome","Microsoft","Mozilla"],"count":37},{"stores":["Microsoft"],"count":32},{"stores":["Chrome","Microsoft","Mozilla"],"count":4},{"stores":["Chrome","Mozilla"],"count":3},{"stores":["Microsoft","Mozilla"],"count":3},{"stores":["Mozilla"],"count":2},{"stores":["Apple","Chrome","Mozilla"],"count":1},{"stores":["Apple","Microsoft"],"count":1}],"capabilities":{"tls":{"cas":74,"pct":83},"ev":{"cas":46,"pct":52},"smime":{"cas":66,"pct":74},"codeSigning":{"cas":23,"pct":26}}},"chromeRootStoreGrowth":{"source":"chromium/src/net/data/ssl/chrome_root_store commit history","entries":[{"date":"2022-02-16","totalRoots":117,"added":117,"removed":0},{"date":"2022-04-01","totalRoots":115,"added":0,"removed":2},{"date":"2022-04-05","totalRoots":128,"added":19,"removed":6},{"date":"2022-04-08","totalRoots":130,"added":2,"removed":0},{"date":"2022-05-19","totalRoots":132,"added":2,"removed":0},{"date":"2022-08-18","totalRoots":140,"added":10,"removed":2},{"date":"2023-01-14","totalRoots":138,"added":0,"removed":2},{"date":"2023-03-02","totalRoots":135,"added":0,"removed":3},{"date":"2023-06-03","totalRoots":131,"added":0,"removed":4},{"date":"2023-09-20","totalRoots":133,"added":2,"removed":0},{"date":"2023-12-03","totalRoots":134,"added":2,"removed":1},{"date":"2024-03-12","totalRoots":136,"added":2,"removed":0},{"date":"2024-05-30","totalRoots":135,"added":0,"removed":1},{"date":"2024-10-05","totalRoots":134,"added":0,"removed":1},{"date":"2025-03-20","totalRoots":244,"added":110,"removed":0},{"date":"2025-04-24","totalRoots":228,"added":1,"removed":17},{"date":"2025-06-20","totalRoots":239,"added":11,"removed":0},{"date":"2025-06-20","totalRoots":228,"added":0,"removed":11},{"date":"2025-07-09","totalRoots":226,"added":2,"removed":4},{"date":"2025-08-12","totalRoots":237,"added":11,"removed":0},{"date":"2025-10-28","totalRoots":236,"added":0,"removed":1},{"date":"2025-12-16","totalRoots":233,"added":1,"removed":4},{"date":"2026-01-08","totalRoots":239,"added":6,"removed":0},{"date":"2026-02-21","totalRoots":242,"added":4,"removed":1},{"date":"2026-04-14","totalRoots":231,"added":1,"removed":12}]},"geography":[{"region":"United States","caCount":15,"issuancePct":89.97,"certs":1338332929,"countries":[{"country":"United States","caCount":15,"issuancePct":89.97}]},{"region":"Europe","caCount":44,"issuancePct":9.95,"certs":148023328,"countries":[{"country":"United Kingdom","caCount":1,"issuancePct":9.64},{"country":"Belgium","caCount":2,"issuancePct":0.11},{"country":"Italy","caCount":1,"issuancePct":0.09},{"country":"Greece","caCount":1,"issuancePct":0.05},{"country":"Poland","caCount":2,"issuancePct":0.05},{"country":"Germany","caCount":4,"issuancePct":0.01},{"country":"Switzerland","caCount":4,"issuancePct":0.0},{"country":"Sweden","caCount":2,"issuancePct":0.0},{"country":"Spain","caCount":9,"issuancePct":0.0},{"country":"Romania","caCount":1,"issuancePct":0.0},{"country":"Hungary","caCount":2,"issuancePct":0.0},{"country":"Finland","caCount":1,"issuancePct":0.0},{"country":"France","caCount":2,"issuancePct":0.0},{"country":"Norway","caCount":1,"issuancePct":0.0},{"country":"Czechia","caCount":2,"issuancePct":0.0},{"country":"Slovakia","caCount":1,"issuancePct":0.0},{"country":"Croatia","caCount":1,"issuancePct":0.0},{"country":"Austria","caCount":2,"issuancePct":0.0},{"country":"Netherlands","caCount":1,"issuancePct":0.0},{"country":"Portugal","caCount":2,"issuancePct":0.0},{"country":"Slovenia","caCount":2,"issuancePct":0.0}]},{"region":"Asia-Pacific","caCount":17,"issuancePct":0.07,"certs":1084708,"countries":[{"country":"China","caCount":8,"issuancePct":0.07},{"country":"Japan","caCount":4,"issuancePct":0.0},{"country":"India","caCount":2,"issuancePct":0.0},{"country":"Singapore","caCount":1,"issuancePct":0.0},{"country":"Australia","caCount":1,"issuancePct":0.0},{"country":"Thailand","caCount":1,"issuancePct":0.0}]},{"region":"Americas","caCount":3,"issuancePct":0.0,"certs":509,"countries":[{"country":"Brazil","caCount":1,"issuancePct":0.0},{"country":"Canada","caCount":2,"issuancePct":0.0}]},{"region":"Middle East / Africa","caCount":6,"issuancePct":0.0,"certs":221,"countries":[{"country":"Turkey","caCount":1,"issuancePct":0.0},{"country":"Tunisia","caCount":1,"issuancePct":0.0},{"country":"Israel","caCount":1,"issuancePct":0.0},{"country":"South Africa","caCount":2,"issuancePct":0.0},{"country":"Saudi Arabia","caCount":1,"issuancePct":0.0}]}],"governmentRisk":{"total":30,"issuancePct":0.06,"byType":{"governmentOperated":{"count":21,"certs":13427,"pct":0.0},"stateOwnedEnterprise":{"count":9,"certs":813309,"pct":0.05}},"cas":[{"caOwner":"HARICA","crtshUrl":"https://crt.sh/?CAName=HARICA","type":"state_owned_enterprise","country":"Greece","relationship":"Operated by Greek academic/research network, government-funded institution","storeCount":4,"certs":720077},{"caOwner":"Telia Company","crtshUrl":"https://crt.sh/?CAName=Telia%20Company","type":"state_owned_enterprise","country":"Sweden","relationship":"Swedish and Finnish state partial ownership (~37% Swedish state)","storeCount":4,"certs":35340},{"caOwner":"Shanghai Electronic Certification Authority Co., Ltd.","crtshUrl":"https://crt.sh/?CAName=Shanghai%20Electronic%20Certification%20Authority%20Co.%2C%20Ltd.","type":"state_owned_enterprise","country":"China","relationship":"State-affiliated entity, Shanghai municipality","storeCount":3,"certs":30500},{"caOwner":"Deutsche Telekom Security GmbH","crtshUrl":"https://crt.sh/?CAName=Deutsche%20Telekom%20Security%20GmbH","type":"state_owned_enterprise","country":"Germany","relationship":"German federal government holds ~30% of Deutsche Telekom via KfW","storeCount":4,"certs":20300},{"caOwner":"China Financial Certification Authority (CFCA)","crtshUrl":"https://crt.sh/?CAName=China%20Financial%20Certification%20Authority%20%28CFCA%29","type":"state_owned_enterprise","country":"China","relationship":"Established by People's Bank of China","storeCount":4,"certs":5188},{"caOwner":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20F%C3%A1brica%20Nacional%20de%20Moneda%20y%20Timbre%20%28FNMT%29","type":"government_operated","country":"Spain","relationship":"Spanish Royal Mint, government agency","storeCount":4,"certs":2940},{"caOwner":"Government of Hong Kong (SAR), Hongkong Post, Certizen","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Hong%20Kong%20%28SAR%29%2C%20Hongkong%20Post%2C%20Certizen","type":"government_operated","country":"Hong Kong","relationship":"Hong Kong Post, SAR government agency","storeCount":4,"certs":2927},{"caOwner":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20Autoritat%20de%20Certificaci%C3%B3%20de%20la%20Comunitat%20Valenciana%20%28ACCV%29","type":"government_operated","country":"Spain","relationship":"Valencian regional government agency","storeCount":4,"certs":2719},{"caOwner":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Finland%2C%20Population%20Register%20Centre%E2%80%99s%20%28V%C3%A4est%C3%B6rekisterikeskus%2C%20VRK%29","type":"government_operated","country":"Finland","relationship":"Finnish population register, government agency","storeCount":1,"certs":2366},{"caOwner":"Autoridad de Certificacion Firmaprofesional","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificacion%20Firmaprofesional","type":"government_operated","country":"Spain","relationship":"Spanish notarial professional body, quasi-governmental","storeCount":4,"certs":1480},{"caOwner":"PostSignum","crtshUrl":"https://crt.sh/?CAName=PostSignum","type":"state_owned_enterprise","country":"Czechia","relationship":"Operated by \u010cesk\u00e1 po\u0161ta, s.p. (Czech Post), a state-owned enterprise of the Czech Republic","storeCount":1,"certs":991},{"caOwner":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Brazil%2C%20Instituto%20Nacional%20de%20Tecnologia%20da%20Informa%C3%A7%C3%A3o%20%28ITI%29","type":"government_operated","country":"Brazil","relationship":"Brazilian federal IT institute, operates ICP-Brasil","storeCount":1,"certs":509},{"caOwner":"Krajowa Izba Rozliczeniowa S.A. (KIR)","crtshUrl":"https://crt.sh/?CAName=Krajowa%20Izba%20Rozliczeniowa%20S.A.%20%28KIR%29","type":"state_owned_enterprise","country":"Poland","relationship":"Polish interbank clearing house, established by statute, owned by National Bank of Poland and commercial banks under state mandate","storeCount":3,"certs":453},{"caOwner":"Financijska agencija (Fina)","crtshUrl":"https://crt.sh/?CAName=Financijska%20agencija%20%28Fina%29","type":"state_owned_enterprise","country":"Croatia","relationship":"Croatian state-owned financial agency","storeCount":1,"certs":307},{"caOwner":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20India%2C%20Ministry%20of%20Communications%20%26%20Information%20Technology%2C%20Controller%20of%20Certifying%20Authorities%20%28CCA%29","type":"government_operated","country":"India","relationship":"Indian federal ministry","storeCount":1,"certs":214},{"caOwner":"Chunghwa Telecom","crtshUrl":"https://crt.sh/?CAName=Chunghwa%20Telecom","type":"state_owned_enterprise","country":"Taiwan","relationship":"Majority state-owned telecom (Taiwan Ministry of Transportation)","storeCount":4,"certs":153},{"caOwner":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Turkey%2C%20Kamu%20Sertifikasyon%20Merkezi%20%28Kamu%20SM%29","type":"government_operated","country":"Turkey","relationship":"Turkish government certification center","storeCount":4,"certs":144},{"caOwner":"Agence Nationale de Certification Electronique","crtshUrl":"https://crt.sh/?CAName=Agence%20Nationale%20de%20Certification%20Electronique","type":"government_operated","country":"Tunisia","relationship":"Tunisian national certification agency","storeCount":3,"certs":77},{"caOwner":"Government of Korea, KLID","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Korea%2C%20KLID","type":"government_operated","country":"South Korea","relationship":"Korean government agency","storeCount":1,"certs":38},{"caOwner":"Autoridad de Certificaci\u00f3n (ANF AC)","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificaci%C3%B3n%20%28ANF%20AC%29","type":"government_operated","country":"Spain","relationship":"Spanish certification authority","storeCount":2,"certs":13},{"caOwner":"Consorci Administraci\u00f3 Oberta de Catalunya (Consorci AOC, CATCert)","crtshUrl":"https://crt.sh/?CAName=Consorci%20Administraci%C3%B3%20Oberta%20de%20Catalunya%20%28Consorci%20AOC%2C%20CATCert%29","type":"government_operated","country":"Spain","relationship":"Public-sector consortium of Catalan regional and local governments, established by act of the Catalan Parliament (Law 29/2010)","storeCount":1,"certs":0},{"caOwner":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","crtshUrl":"https://crt.sh/?CAName=Swiss%20BIT%2C%20Swiss%20Federal%20Office%20of%20Information%20Technology%2C%20Systems%20and%20Telecommunication%20%28FOITT%29","type":"government_operated","country":"Switzerland","relationship":"Swiss Federal Office of Information Technology, Systems and Telecommunication","storeCount":1,"certs":0},{"caOwner":"Government of The Netherlands, PKIoverheid (Logius)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20The%20Netherlands%2C%20PKIoverheid%20%28Logius%29","type":"government_operated","country":"Netherlands","relationship":"Dutch government PKI operated by Logius","storeCount":2,"certs":0},{"caOwner":"SI-TRUST","crtshUrl":"https://crt.sh/?CAName=SI-TRUST","type":"government_operated","country":"Slovenia","relationship":"Slovenian government trust service provider","storeCount":1,"certs":0},{"caOwner":"Government of Japan, Digital Agency","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Japan%2C%20Digital%20Agency","type":"government_operated","country":"Japan","relationship":"Japanese Digital Agency, cabinet-level","storeCount":1,"certs":0},{"caOwner":"Consejo General de la Abogac\u00eda Espa\u00f1ola","crtshUrl":"https://crt.sh/?CAName=Consejo%20General%20de%20la%20Abogac%C3%ADa%20Espa%C3%B1ola","type":"government_operated","country":"Spain","relationship":"Spanish General Council of Bar Associations \u2014 statutory professional body established by Spanish law","storeCount":1,"certs":0},{"caOwner":"Government of Sweden (F\u00f6rs\u00e4kringskassan)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Sweden%20%28F%C3%B6rs%C3%A4kringskassan%29","type":"government_operated","country":"Sweden","relationship":"Swedish Social Insurance Agency","storeCount":1,"certs":0},{"caOwner":"Department of Defence Australia","crtshUrl":"https://crt.sh/?CAName=Department%20of%20Defence%20Australia","type":"government_operated","country":"Australia","relationship":"Australian Department of Defence, federal government","storeCount":1,"certs":0},{"caOwner":"Macao Post and Telecommunications Bureau","crtshUrl":"https://crt.sh/?CAName=Macao%20Post%20and%20Telecommunications%20Bureau","type":"government_operated","country":"Macao","relationship":"Macao SAR government postal and telecom bureau","storeCount":1,"certs":0},{"caOwner":"Thailand National Root Certificate Authority (Electronic Transactions Development Agency)","crtshUrl":"https://crt.sh/?CAName=Thailand%20National%20Root%20Certificate%20Authority%20%28Electronic%20Transactions%20Development%20Agency%29","type":"government_operated","country":"Thailand","relationship":"Thai Electronic Transactions Development Agency","storeCount":1,"certs":0}]},"jurisdictionRisk":[{"country":"China","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"Mandatory cooperation for all organizations (NIL Art. 7/14); full SCA access to systems and keys in critical information infrastructure (Cryptography Law Art. 31).","laws":[{"name":"National Intelligence Law (2017)","section":"Articles 7, 14","excerpt":"All organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law."},{"name":"Cryptography Law (2019)","section":"Article 31","excerpt":"SCA and local agencies have complete access to the cryptography system and to the data protected by that system."},{"name":"Cybersecurity Law (2016)","section":"Article 28","excerpt":"Network operators shall provide technical support and assistance to public security organs and national security organs."}],"caCount":8,"exposedCerts":984063},{"country":"Russia","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"FSB direct access via SORM; Yarovaya Law requires encryption key disclosure without court order.","laws":[{"name":"Yarovaya Law (2016)","section":"Federal Law 374-FZ","excerpt":"Any online service that uses encrypted data is required to permit the FSB to access encrypted communications, including providing any encryption keys."},{"name":"SORM Regulations (1995+)","section":"System for Operative Investigative Activities","excerpt":"FSB has access to electronic messages and the keys to decrypt these without judicial authorization."}],"caCount":0,"exposedCerts":0},{"country":"United Kingdom","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"RIPA s.49 compels key disclosure with up to 5yr penalty; IPA 2016 Technical Capability Notices; tipping-off ban prevents disclosure to auditors.","laws":[{"name":"RIPA 2000, Part III","section":"Sections 49, 53, 54","excerpt":"A disclosure requirement is necessary if it is necessary (a) in the interests of national security; (b) for preventing or detecting crime; (c) in the interests of the economic well-being of the UK."},{"name":"Investigatory Powers Act 2016","section":"Technical Capability Notices","excerpt":"Government can serve Technical Capability Notices requiring operators to remove electronic protection on communications on an ongoing basis."}],"caCount":1,"exposedCerts":143435943},{"country":"Australia","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"TOLA Act TANs/TCNs compel decryption assistance from broad DCP class; 5yr gag order penalty; 10yr for warrant non-compliance.","laws":[{"name":"Assistance and Access Act 2018 (TOLA)","section":"TAR / TAN / TCN framework","excerpt":"DCPs include software developers, device manufacturers, and anyone who provides services that facilitate a carriage or electronic service."}],"caCount":1,"exposedCerts":0},{"country":"India","risk":"moderate","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"none"},"summary":"IT Act s.69 executive orders to intermediaries; no judicial oversight; 7yr penalty for noncompliance.","laws":[{"name":"Information Technology Act 2000 (amended 2008)","section":"Section 69(1)(3)(4)","excerpt":"The subscriber or intermediary or any person in-charge of the computer resource shall assist the agency to intercept, monitor, or decrypt the information. Failure: imprisonment up to seven years."}],"caCount":2,"exposedCerts":26345},{"country":"United States","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Judicial oversight required; CALEA limits carrier decryption duty; All Writs Act and NSLs (with gag) possible. Lavabit precedent for SSL keys.","laws":[{"name":"CALEA (1994)","section":"Section 103(a)","excerpt":"A carrier shall not be responsible for decrypting any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier."},{"name":"NSLs / All Writs Act","section":"18 USC \u00a72709; 28 USC \u00a71651","excerpt":"Lavabit shut down rather than surrender its master private keys due to the government wanting to spy on Edward Snowden's emails."}],"caCount":15,"exposedCerts":1338332929},{"country":"France","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Judicial orders only; 3yr / \u20ac270K penalty for refusal.","laws":[{"name":"Code of Criminal Procedure","section":"Article 230-1","excerpt":"A judge may designate a technical expert to obtain plaintext from encrypted data seized during an investigation."}],"caCount":2,"exposedCerts":1854},{"country":"New Zealand","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"general","secrecy":"none"},"summary":"TICSA requires interception capability; Search and Surveillance Act s.130 compels key access under warrant.","laws":[{"name":"TICSA (2013)","section":"Interception capability","excerpt":"Network operators must decrypt communications if they have provided the encryption or hold the decryption key."}],"caCount":0,"exposedCerts":0},{"country":"South Africa","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"RICA s.21 requires provider decryption assistance if key held. Key safeguards struck down by Constitutional Court in 2021; amendments pending.","laws":[{"name":"RICA 2002","section":"Section 21","excerpt":"Encrypted communications must be provided in decrypted form if the provider holds the decryption key."}],"caCount":2,"exposedCerts":0},{"country":"Turkey","risk":"moderate","axes":{"keySeizure":"purpose","compelledIssuance":"none","secrecy":"none"},"summary":"BTK orders for hosting/access providers; electronic communications law requires interception capability.","laws":[{"name":"Law No. 5651 (2007, amended)","section":"BTK authority","excerpt":"Hosting and access providers must comply with government orders including providing access to encrypted data."}],"caCount":1,"exposedCerts":144},{"country":"Cambodia","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"E-Commerce Law Art. 43 prohibits encrypting evidence; untested but broadly worded.","laws":[{"name":"Law on Electronic Commerce (2019)","section":"Article 43","excerpt":"Prohibits any encryption of evidence in the form of data that could lead to an indictment, or any evidence in an electronic system that relates to an offense."}],"caCount":0,"exposedCerts":0},{"country":"Belgium","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Third-party (non-suspect) assistance only; judicial order required. GlobalSign incorporated here.","laws":[{"name":"Code of Criminal Procedure","section":"Article 88quater","excerpt":"A judge may order non-suspect third parties to provide decryption assistance. Suspects protected by self-incrimination principle."}],"caCount":2,"exposedCerts":1582543},{"country":"Finland","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"System admins compelled; suspects exempt under Coercive Measures Act.","laws":[{"name":"Coercive Measures Act (2011)","section":"Chapter 8","excerpt":"System owners and administrators must surrender necessary passwords. Suspects themselves are exempt."}],"caCount":1,"exposedCerts":2366},{"country":"Germany","risk":"low","axes":{"keySeizure":"none","compelledIssuance":"none","secrecy":"none"},"summary":"Strong nemo tenetur; no compulsion for suspects; regulatory readability obligations only in non-criminal contexts.","laws":[{"name":"Strafprozessordnung (StPO)","section":"Criminal Procedure Code","excerpt":"Suspects cannot be compelled to hand over any kind of cryptographic key due to the nemo tenetur principle."}],"caCount":4,"exposedCerts":89152},{"country":"Canada","risk":"low","axes":{"keySeizure":"none","compelledIssuance":"none","secrecy":"none"},"summary":"Charter s.11(c) protects against compelled self-incrimination. No statutory key-disclosure law. Strongest Five Eyes protections.","laws":[{"name":"Charter of Rights and Freedoms (1982)","section":"Section 11(c)","excerpt":"No legislative power can require individuals to decrypt encrypted communications. The federal government has recognised it has no legislative authority to compel individuals to provide a password."}],"caCount":2,"exposedCerts":0},{"country":"Hong Kong","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"general","secrecy":"purpose"},"summary":"NSL Art.43 allows police to search/seize electronic devices and compel assistance without judicial oversight for national security matters; Schedule 6 para 3 imposes statutory non-disclosure obligation on assisting parties. Pre-NSL, ICSO Cap.589 required panel judge authorization; post-2020 NSL creates a parallel track with executive authorization and no independent oversight.","laws":[{"name":"National Security Law (2020)","section":"Article 43; Schedule 6 paragraphs 3, 7","excerpt":""},{"name":"Interception of Communications and Surveillance Ordinance (Cap. 589)","section":"ICSO \u2014 superseded by NSL for national security matters","excerpt":""}],"caCount":0,"exposedCerts":0},{"country":"Netherlands","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Art.126m(6) DCCP compels third parties with knowledge of an encryption method to assist decryption when a serious offence is suspected; cannot target the suspect (Art.126m(7)). Judicial oversight via public prosecutor order. No compelled issuance mechanism or statutory gag.","laws":[{"name":"Code of Criminal Procedure (Wetboek van Strafvordering)","section":"Article 126m(6), 126m(7)","excerpt":""}],"caCount":1,"exposedCerts":0},{"country":"Spain","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"LECrim Art.588ter (Organic Law 13/2015) requires judicial order for interception of telecommunications. LGTel Art.39.11 requires operators to deliver communications free of encryption effects where reversible. Judicial oversight required throughout; no statutory compelled issuance or gag.","laws":[{"name":"Ley de Enjuiciamiento Criminal (LECrim)","section":"Article 588ter a; Article 588 bis a","excerpt":""},{"name":"General Telecommunications Act (LGTel, Law 11/2022)","section":"Article 39.11","excerpt":""}],"caCount":9,"exposedCerts":8289},{"country":"Brazil","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Law 9.296/1996 Art.1 requires judicial order for interception; providers must make available technological resources to suspend confidentiality including decryption where provider has capability. Brazilian courts have applied this aggressively \u2014 executives arrested and services suspended to compel compliance (WhatsApp, 2015\u20132016). No compelled issuance statute; no gag provision.","laws":[{"name":"Lei 9.296/1996 (Communications Interception Law)","section":"Article 1","excerpt":""},{"name":"Marco Civil da Internet (Law 12.965/2014)","section":"Article 7(II), Article 10","excerpt":""}],"caCount":1,"exposedCerts":509},{"country":"Greece","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Presidential Decree 47 compels service providers to decrypt communications and stored data on competent authority request. Law 2225/1994 as amended governs lawful interception; judicial order required. No purpose-built key seizure statute targeting CA signing keys; no compelled issuance mechanism; no statutory gag.","laws":[{"name":"Presidential Decree 47","section":"Provider decryption obligation","excerpt":""},{"name":"Law 2225/1994 (as amended)","section":"Lawful interception framework","excerpt":""}],"caCount":1,"exposedCerts":720077},{"country":"Switzerland","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"B\u00dcPF (SR 780.1) Art.22 requires providers to hand over available data under judicial order. No general key-disclosure mandate in current law; proposed V\u00dcPF Art.50a decryption requirement is not yet enacted (consultation closed May 2025, outcome pending). No compelled issuance mechanism; no gag provision.","laws":[{"name":"Federal Act on the Surveillance of Post and Telecommunications (B\u00dcPF, SR 780.1)","section":"Article 22","excerpt":""}],"caCount":4,"exposedCerts":56386}],"incidents":{"total":1511,"caCount":54,"years":[{"year":2014,"count":2},{"year":2015,"count":1},{"year":2016,"count":5},{"year":2017,"count":80},{"year":2018,"count":78},{"year":2019,"count":196},{"year":2020,"count":203},{"year":2021,"count":161},{"year":2022,"count":96},{"year":2023,"count":126},{"year":2024,"count":200},{"year":2025,"count":214},{"year":2026,"count":149}],"perCA":[{"ca":"DigiCert","id":"digicert","count":176,"selfReported":85,"externallyReported":91,"selfReportPct":48,"ppm":0.141,"trusted":true},{"ca":"Sectigo","id":"sectigo","count":112,"selfReported":70,"externallyReported":42,"selfReportPct":62,"ppm":0.08,"trusted":true},{"ca":"IdenTrust Services, LLC","id":"identrust-services-llc","count":77,"selfReported":63,"externallyReported":14,"selfReportPct":82,"ppm":1.732,"trusted":true},{"ca":"SwissSign AG","id":"swisssign-ag","count":65,"selfReported":50,"externallyReported":15,"selfReportPct":77,"ppm":347.46,"trusted":true},{"ca":"GlobalSign nv-sa","id":"globalsign-nv-sa","count":56,"selfReported":34,"externallyReported":22,"selfReportPct":61,"ppm":1.046,"trusted":true},{"ca":"Microsoft Corporation","id":"microsoft-corporation","count":51,"selfReported":25,"externallyReported":26,"selfReportPct":49,"ppm":0.141,"trusted":true},{"ca":"Asseco Data Systems S.A.","id":"asseco-data-systems-s-a","count":50,"selfReported":27,"externallyReported":23,"selfReportPct":54,"ppm":8.139,"trusted":true},{"ca":"GoDaddy","id":"godaddy","count":47,"selfReported":27,"externallyReported":20,"selfReportPct":57,"ppm":0.094,"trusted":true},{"ca":"Government of The Netherlands, PKIoverheid (Logius)","id":"government-of-the-netherlands-pkioverheid-logius","count":45,"selfReported":32,"externallyReported":13,"selfReportPct":71,"ppm":11250000.0,"trusted":true},{"ca":"Autoridad de Certificacion Firmaprofesional","id":"autoridad-de-certificacion-firmaprofesional","count":41,"selfReported":28,"externallyReported":13,"selfReportPct":68,"ppm":3859.55,"trusted":true},{"ca":"Netlock","id":"netlock","count":41,"selfReported":25,"externallyReported":16,"selfReportPct":61,"ppm":2040.715,"trusted":true},{"ca":"Internet Security Research Group","id":"internet-security-research-group","count":40,"selfReported":20,"externallyReported":20,"selfReportPct":50,"ppm":0.004,"trusted":true},{"ca":"Google Trust Services LLC","id":"google-trust-services-llc","count":39,"selfReported":8,"externallyReported":31,"selfReportPct":21,"ppm":0.018,"trusted":true},{"ca":"Telia Company","id":"telia-company","count":37,"selfReported":25,"externallyReported":12,"selfReportPct":68,"ppm":261.401,"trusted":true},{"ca":"SECOM Trust Systems CO., LTD.","id":"secom-trust-systems-co-ltd","count":36,"selfReported":19,"externallyReported":17,"selfReportPct":53,"ppm":72.0,"trusted":true},{"ca":"D-TRUST","id":"d-trust","count":33,"selfReported":22,"externallyReported":11,"selfReportPct":67,"ppm":190.805,"trusted":true},{"ca":"China Financial Certification Authority (CFCA)","id":"china-financial-certification-authority-cfca","count":33,"selfReported":16,"externallyReported":17,"selfReportPct":48,"ppm":1175.884,"trusted":true},{"ca":"SSL.com","id":"ssl-com","count":31,"selfReported":17,"externallyReported":14,"selfReportPct":55,"ppm":0.287,"trusted":true},{"ca":"Certigna","id":"certigna","count":30,"selfReported":14,"externallyReported":16,"selfReportPct":47,"ppm":379.439,"trusted":true},{"ca":"Deutsche Telekom Security GmbH","id":"deutsche-telekom-security-gmbh","count":29,"selfReported":14,"externallyReported":15,"selfReportPct":48,"ppm":230.8,"trusted":true},{"ca":"Chunghwa Telecom","id":"chunghwa-telecom","count":29,"selfReported":21,"externallyReported":8,"selfReportPct":72,"ppm":694.761,"trusted":true},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","id":"shanghai-electronic-certification-authority-co-ltd","count":27,"selfReported":19,"externallyReported":8,"selfReportPct":70,"ppm":394.604,"trusted":true},{"ca":"Actalis","id":"actalis","count":24,"selfReported":15,"externallyReported":9,"selfReportPct":62,"ppm":3.48,"trusted":true},{"ca":"Izenpe S.A.","id":"izenpe-s-a","count":23,"selfReported":13,"externallyReported":10,"selfReportPct":57,"ppm":3037.908,"trusted":true},{"ca":"certSIGN","id":"certsign","count":23,"selfReported":17,"externallyReported":6,"selfReportPct":74,"ppm":1186.117,"trusted":true},{"ca":"eMudhra Technologies Limited","id":"emudhra-technologies-limited","count":21,"selfReported":17,"externallyReported":4,"selfReportPct":81,"ppm":381.527,"trusted":true},{"ca":"Krajowa Izba Rozliczeniowa S.A. (KIR)","id":"krajowa-izba-rozliczeniowa-s-a-kir","count":20,"selfReported":0,"externallyReported":20,"selfReportPct":0,"ppm":6420.546,"trusted":true},{"ca":"Viking Cloud, Inc.","id":"viking-cloud-inc","count":20,"selfReported":8,"externallyReported":12,"selfReportPct":40,"ppm":null,"trusted":false},{"ca":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","id":"government-of-spain-f-brica-nacional-de-moneda-y-timbre-fnmt","count":19,"selfReported":15,"externallyReported":4,"selfReportPct":79,"ppm":1133.719,"trusted":true},{"ca":"HARICA","id":"harica","count":19,"selfReported":11,"externallyReported":8,"selfReportPct":58,"ppm":22.345,"trusted":true},{"ca":"Microsec Ltd.","id":"microsec-ltd","count":17,"selfReported":11,"externallyReported":6,"selfReportPct":65,"ppm":1404.959,"trusted":true},{"ca":"WISeKey","id":"wisekey","count":16,"selfReported":11,"externallyReported":5,"selfReportPct":69,"ppm":985.04,"trusted":true},{"ca":"Amazon Trust Services","id":"amazon-trust-services","count":16,"selfReported":8,"externallyReported":8,"selfReportPct":50,"ppm":0.877,"trusted":true},{"ca":"Buypass","id":"buypass","count":16,"selfReported":14,"externallyReported":2,"selfReportPct":88,"ppm":12.365,"trusted":true},{"ca":"Taiwan-CA Inc. (TWCA)","id":"taiwan-ca-inc-twca","count":15,"selfReported":9,"externallyReported":6,"selfReportPct":60,"ppm":40.978,"trusted":true},{"ca":"Apple Inc.","id":"apple-inc","count":15,"selfReported":15,"externallyReported":0,"selfReportPct":100,"ppm":null,"trusted":false},{"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","id":"autoridad-de-certificaci-n-anf-ac","count":13,"selfReported":12,"externallyReported":1,"selfReportPct":92,"ppm":288888.889,"trusted":true},{"ca":"Disig, a.s.","id":"disig-a-s","count":11,"selfReported":6,"externallyReported":5,"selfReportPct":55,"ppm":6462.985,"trusted":true},{"ca":"Certainly LLC","id":"certainly-llc","count":11,"selfReported":3,"externallyReported":8,"selfReportPct":27,"ppm":0.8,"trusted":true},{"ca":"NAVER Cloud Trust Services","id":"naver-cloud-trust-services","count":10,"selfReported":7,"externallyReported":3,"selfReportPct":70,"ppm":413.343,"trusted":true},{"ca":"Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA))","id":"global-digital-cybersecurity-authority-co-ltd-formerly-guang-dong-certificate-authority-gdca","count":9,"selfReported":7,"externallyReported":2,"selfReportPct":78,"ppm":1445.783,"trusted":true},{"ca":"iTrusChina","id":"itruschina","count":9,"selfReported":7,"externallyReported":2,"selfReportPct":78,"ppm":null,"trusted":false},{"ca":"Consorci AOC","id":"consorci-aoc","count":8,"selfReported":2,"externallyReported":6,"selfReportPct":25,"ppm":null,"trusted":false},{"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","id":"government-of-hong-kong-sar-hongkong-post-certizen","count":8,"selfReported":7,"externallyReported":1,"selfReportPct":88,"ppm":473.429,"trusted":true},{"ca":"CommScope","id":"commscope","count":8,"selfReported":5,"externallyReported":3,"selfReportPct":62,"ppm":null,"trusted":false},{"ca":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","id":"government-of-spain-autoritat-de-certificaci-de-la-comunitat-valenciana-accv","count":7,"selfReported":5,"externallyReported":2,"selfReportPct":71,"ppm":395.592,"trusted":true},{"ca":"Eviden","id":"eviden","count":6,"selfReported":3,"externallyReported":3,"selfReportPct":50,"ppm":null,"trusted":false},{"ca":"Agence Nationale de Certification Electronique","id":"agence-nationale-de-certification-electronique","count":5,"selfReported":4,"externallyReported":1,"selfReportPct":80,"ppm":5938.242,"trusted":true},{"ca":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","id":"government-of-turkey-kamu-sertifikasyon-merkezi-kamu-sm","count":4,"selfReported":1,"externallyReported":3,"selfReportPct":25,"ppm":4110.997,"trusted":true},{"ca":"Visa","id":"visa","count":3,"selfReported":0,"externallyReported":3,"selfReportPct":0,"ppm":6880.734,"trusted":true},{"ca":"Cybertrust Japan Co., Ltd.","id":"cybertrust-japan-co-ltd","count":3,"selfReported":1,"externallyReported":2,"selfReportPct":33,"ppm":14.147,"trusted":true},{"ca":"TrustAsia Technologies, Inc.","id":"trustasia-technologies-inc","count":3,"selfReported":3,"externallyReported":0,"selfReportPct":100,"ppm":1.908,"trusted":true},{"ca":"SK ID Solutions AS","id":"sk-id-solutions-as","count":2,"selfReported":0,"externallyReported":2,"selfReportPct":0,"ppm":null,"trusted":false},{"ca":"PostSignum","id":"postsignum","count":2,"selfReported":2,"externallyReported":0,"selfReportPct":100,"ppm":354.484,"trusted":true}],"classification":{"misissuance":588,"revocation":325,"governance":476,"validation":122},"yearsByClass":[{"year":2014,"misissuance":2,"revocation":0,"governance":0,"validation":0},{"year":2015,"misissuance":1,"revocation":0,"governance":0,"validation":0},{"year":2016,"misissuance":3,"revocation":0,"governance":0,"validation":2},{"year":2017,"misissuance":45,"revocation":14,"governance":9,"validation":12},{"year":2018,"misissuance":40,"revocation":5,"governance":26,"validation":7},{"year":2019,"misissuance":111,"revocation":29,"governance":47,"validation":9},{"year":2020,"misissuance":82,"revocation":62,"governance":47,"validation":12},{"year":2021,"misissuance":73,"revocation":33,"governance":37,"validation":18},{"year":2022,"misissuance":35,"revocation":36,"governance":15,"validation":10},{"year":2023,"misissuance":48,"revocation":38,"governance":27,"validation":13},{"year":2024,"misissuance":76,"revocation":48,"governance":56,"validation":20},{"year":2025,"misissuance":42,"revocation":32,"governance":129,"validation":11},{"year":2026,"misissuance":30,"revocation":28,"governance":83,"validation":8}],"fingerprints":[{"ca":"DigiCert","misissuance":83,"revocation":33,"governance":42,"validation":18},{"ca":"Sectigo","misissuance":47,"revocation":19,"governance":23,"validation":23},{"ca":"IdenTrust Services, LLC","misissuance":30,"revocation":24,"governance":21,"validation":2},{"ca":"SwissSign AG","misissuance":31,"revocation":9,"governance":24,"validation":1},{"ca":"GlobalSign nv-sa","misissuance":33,"revocation":14,"governance":4,"validation":5},{"ca":"Microsoft Corporation","misissuance":13,"revocation":9,"governance":29,"validation":0},{"ca":"Asseco Data Systems S.A.","misissuance":23,"revocation":10,"governance":13,"validation":4},{"ca":"GoDaddy","misissuance":13,"revocation":16,"governance":10,"validation":8},{"ca":"Government of The Netherlands, PKIoverheid (Logius)","misissuance":7,"revocation":3,"governance":35,"validation":0},{"ca":"Autoridad de Certificacion Firmaprofesional","misissuance":8,"revocation":3,"governance":30,"validation":0},{"ca":"Netlock","misissuance":10,"revocation":11,"governance":19,"validation":1},{"ca":"Internet Security Research Group","misissuance":10,"revocation":18,"governance":4,"validation":8},{"ca":"Google Trust Services LLC","misissuance":6,"revocation":14,"governance":13,"validation":6},{"ca":"Telia Company","misissuance":20,"revocation":3,"governance":12,"validation":2},{"ca":"SECOM Trust Systems CO., LTD.","misissuance":19,"revocation":7,"governance":10,"validation":0},{"ca":"D-TRUST","misissuance":18,"revocation":8,"governance":7,"validation":0},{"ca":"China Financial Certification Authority (CFCA)","misissuance":16,"revocation":6,"governance":11,"validation":0},{"ca":"SSL.com","misissuance":7,"revocation":9,"governance":3,"validation":12},{"ca":"Certigna","misissuance":11,"revocation":4,"governance":14,"validation":1},{"ca":"Deutsche Telekom Security GmbH","misissuance":19,"revocation":5,"governance":4,"validation":1},{"ca":"Chunghwa Telecom","misissuance":4,"revocation":4,"governance":17,"validation":4},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","misissuance":10,"revocation":7,"governance":10,"validation":0},{"ca":"Actalis","misissuance":9,"revocation":10,"governance":5,"validation":0},{"ca":"Izenpe S.A.","misissuance":12,"revocation":4,"governance":6,"validation":1},{"ca":"certSIGN","misissuance":8,"revocation":3,"governance":12,"validation":0},{"ca":"eMudhra Technologies Limited","misissuance":4,"revocation":8,"governance":8,"validation":1},{"ca":"Krajowa Izba Rozliczeniowa S.A. (KIR)","misissuance":10,"revocation":5,"governance":5,"validation":0},{"ca":"Viking Cloud, Inc.","misissuance":7,"revocation":4,"governance":8,"validation":1},{"ca":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","misissuance":7,"revocation":1,"governance":10,"validation":1},{"ca":"HARICA","misissuance":9,"revocation":5,"governance":1,"validation":4},{"ca":"Microsec Ltd.","misissuance":10,"revocation":2,"governance":5,"validation":0},{"ca":"WISeKey","misissuance":9,"revocation":5,"governance":1,"validation":1},{"ca":"Amazon Trust Services","misissuance":5,"revocation":2,"governance":4,"validation":5},{"ca":"Buypass","misissuance":5,"revocation":4,"governance":4,"validation":3},{"ca":"Taiwan-CA Inc. (TWCA)","misissuance":8,"revocation":3,"governance":4,"validation":0},{"ca":"Apple Inc.","misissuance":2,"revocation":7,"governance":5,"validation":1},{"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","misissuance":1,"revocation":1,"governance":11,"validation":0},{"ca":"Disig, a.s.","misissuance":5,"revocation":1,"governance":5,"validation":0},{"ca":"Certainly LLC","misissuance":1,"revocation":6,"governance":2,"validation":2},{"ca":"NAVER Cloud Trust Services","misissuance":6,"revocation":0,"governance":3,"validation":1},{"ca":"Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA))","misissuance":5,"revocation":3,"governance":0,"validation":1},{"ca":"iTrusChina","misissuance":1,"revocation":2,"governance":5,"validation":1},{"ca":"Consorci AOC","misissuance":3,"revocation":2,"governance":3,"validation":0},{"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","misissuance":5,"revocation":2,"governance":1,"validation":0},{"ca":"CommScope","misissuance":2,"revocation":1,"governance":3,"validation":2},{"ca":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","misissuance":3,"revocation":1,"governance":3,"validation":0},{"ca":"Eviden","misissuance":3,"revocation":0,"governance":3,"validation":0},{"ca":"Agence Nationale de Certification Electronique","misissuance":2,"revocation":3,"governance":0,"validation":0},{"ca":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","misissuance":3,"revocation":1,"governance":0,"validation":0},{"ca":"Visa","misissuance":1,"revocation":1,"governance":1,"validation":0},{"ca":"Cybertrust Japan Co., Ltd.","misissuance":0,"revocation":2,"governance":1,"validation":0},{"ca":"TrustAsia Technologies, Inc.","misissuance":1,"revocation":0,"governance":1,"validation":1},{"ca":"SK ID Solutions AS","misissuance":1,"revocation":0,"governance":1,"validation":0},{"ca":"PostSignum","misissuance":2,"revocation":0,"governance":0,"validation":0}],"categories":[{"category":"Misissuance","count":588},{"category":"Governance","count":476},{"category":"Revocation","count":325},{"category":"Validation","count":122}],"whiteboardTags":{"ca-compliance":1479,"ov-misissuance":320,"ev-misissuance":175,"policy-failure":175,"disclosure-failure":132,"ocsp-failure":131,"dv-misissuance":119,"audit-finding":107,"leaf-revocation-delay":100,"crl-failure":88,"ca-misissuance":58,"audit-failure":48,"uncategorized":45,"smime-misissuance":41,"external":32,"ca-revocation-delay":31,"audit-delay":17,"covid-19":7,"disclosure failure":7,"ca-onecrl":4,"ca-investigation":3,"remediation-accepted":3,"ca compliance":2,"__-misissuance":2,"iv-misissuance":1,"ca-infosharing":1,"ca-informational":1,"close on 2025-06-03":1,"close on 2025-12-10":1,"close on 2025-12-11":1,"close on 2025-12-08":1,"close on 2026-07-16":1,"code-signing-misissuance":1,"close on 2026-07-21":1,"cs-misissuance":1}},"brThresholds":[{"from":"2020-09-01","days":398,"label":"398 days"},{"from":"2026-03-15","days":200,"label":"200 days"},{"from":"2027-03-15","days":100,"label":"100 days"},{"from":"2029-03-15","days":47,"label":"47 days"}],"brReadiness":{"cas":[{"ca":"OISTE","useDays":347,"status":"subscriber_risk","share":0.0003,"unexpiredCerts":4455},{"ca":"HARICA","useDays":309,"status":"subscriber_risk","share":0.0484,"unexpiredCerts":720077},{"ca":"Amazon Trust Services","useDays":255,"status":"subscriber_risk","share":0.8559,"unexpiredCerts":12732987},{"ca":"TrustAsia Technologies, Inc.","useDays":219,"status":"subscriber_risk","share":0.0635,"unexpiredCerts":944539},{"ca":"eMudhra Technologies Limited","useDays":173,"status":"risk_2027","share":0.0018,"unexpiredCerts":26131},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","useDays":163,"status":"risk_2027","share":0.0021,"unexpiredCerts":30500},{"ca":"D-Trust","useDays":143,"status":"risk_2027","share":0.0046,"unexpiredCerts":67735},{"ca":"IdenTrust Services, LLC","useDays":139,"status":"risk_2027","share":1.1374,"unexpiredCerts":16921315},{"ca":"NAVER Cloud Trust Services","useDays":134,"status":"risk_2027","share":0.0006,"unexpiredCerts":8914},{"ca":"GoDaddy","useDays":110,"status":"risk_2027","share":10.1983,"unexpiredCerts":151723226},{"ca":"SwissSign AG","useDays":98,"status":"risk_2029","share":0.0034,"unexpiredCerts":50055},{"ca":"Telia Company","useDays":91,"status":"risk_2029","share":0.0024,"unexpiredCerts":35340},{"ca":"Microsec Ltd.","useDays":88,"status":"risk_2029","share":0.0002,"unexpiredCerts":2925},{"ca":"certSIGN","useDays":76,"status":"risk_2029","share":0.0003,"unexpiredCerts":4046},{"ca":"Open Access Technology International, Inc. (OATI)","useDays":74,"status":"risk_2029","share":0.0002,"unexpiredCerts":2471},{"ca":"Actalis","useDays":73,"status":"risk_2029","share":0.0933,"unexpiredCerts":1387517},{"ca":"Microsoft Corporation","useDays":68,"status":"risk_2029","share":4.5073,"unexpiredCerts":67056190},{"ca":"China Financial Certification Authority (CFCA)","useDays":67,"status":"risk_2029","share":0.0003,"unexpiredCerts":5188},{"ca":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","useDays":64,"status":"risk_2029","share":0.0002,"unexpiredCerts":2940},{"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","useDays":63,"status":"risk_2029","share":0.0002,"unexpiredCerts":2927},{"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","useDays":62,"status":"risk_2029","share":0.0002,"unexpiredCerts":2366},{"ca":"DigiCert","useDays":59,"status":"risk_2029","share":13.6825,"unexpiredCerts":203559616},{"ca":"Cybertrust Japan Co., Ltd.","useDays":59,"status":"risk_2029","share":0.0023,"unexpiredCerts":34358},{"ca":"Deutsche Telekom Security GmbH","useDays":59,"status":"risk_2029","share":0.0014,"unexpiredCerts":20300},{"ca":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","useDays":56,"status":"risk_2029","share":0.0002,"unexpiredCerts":2719},{"ca":"Taiwan-CA Inc. (TWCA)","useDays":55,"status":"risk_2029","share":0.0037,"unexpiredCerts":55000},{"ca":"Izenpe S.A.","useDays":53,"status":"risk_2029","share":0.0001,"unexpiredCerts":1094},{"ca":"Autoridad de Certificacion Firmaprofesional","useDays":51,"status":"risk_2029","share":0.0001,"unexpiredCerts":1480},{"ca":"Google Trust Services LLC","useDays":49,"status":"risk_2029","share":18.9139,"unexpiredCerts":281388034},{"ca":"SSL.com","useDays":44,"status":"compliant","share":0.8782,"unexpiredCerts":13065487},{"ca":"WISeKey","useDays":42,"status":"compliant","share":0.0001,"unexpiredCerts":1876},{"ca":"Asseco Data Systems S.A.","useDays":41,"status":"compliant","share":0.0466,"unexpiredCerts":692738},{"ca":"Sectigo","useDays":37,"status":"compliant","share":9.6412,"unexpiredCerts":143435943},{"ca":"SECOM Trust Systems Co., Ltd.","useDays":29,"status":"compliant","share":0.0027,"unexpiredCerts":39940},{"ca":"Internet Security Research Group","useDays":23,"status":"compliant","share":39.7747,"unexpiredCerts":591742571},{"ca":"Atos","useDays":22,"status":"compliant","share":0.0001,"unexpiredCerts":1117},{"ca":"GlobalSign nv-sa","useDays":11,"status":"compliant","share":0.1064,"unexpiredCerts":1582543},{"ca":"Certigna","useDays":9,"status":"compliant","share":0.0001,"unexpiredCerts":1854},{"ca":"Certainly LLC","useDays":4,"status":"compliant","share":0.0095,"unexpiredCerts":140922},{"ca":"Buypass","useDays":0,"status":"compliant","share":0.0001,"unexpiredCerts":1510}],"totalActiveTls":40,"subscriberRisk200d":4,"subscriberRisk100d":6,"ready47d":11,"medianUseDays":63},"cryptoSummary":{"totalRoots":329,"caCount":89,"keyFamilies":{"RSA":235,"ECC":94},"keySizes":{"RSA-4096":182,"P-384":83,"RSA-2048":51,"P-521":6,"P-256":5,"RSA-3072":2},"sigHashes":{"SHA-384":146,"SHA-256":115,"SHA-1":38,"SHA-512":30}},"rootAlgorithms":{"totalRoots":329,"byKeyFamily":{"RSA":235,"ECC":94},"byKeyBits":{"4096":182,"384":83,"2048":51,"521":6,"256":5,"3072":2},"bySigHash":{"SHA-384":146,"SHA-256":115,"SHA-1":38,"SHA-512":30},"tlsCapable":198,"evCapable":106,"sha1Roots":38,"perCA":[{"rsa":29,"ecc":11,"roots":40,"crtshUrl":"https://crt.sh/?CAName=DigiCert"},{"rsa":18,"ecc":8,"roots":26,"crtshUrl":"https://crt.sh/?CAName=Sectigo"},{"rsa":10,"ecc":8,"roots":18,"crtshUrl":"https://crt.sh/?CAName=SSL.com"},{"rsa":9,"ecc":7,"roots":16,"crtshUrl":"https://crt.sh/?CAName=eMudhra%20Technologies%20Limited"},{"rsa":10,"ecc":6,"roots":16,"crtshUrl":"https://crt.sh/?CAName=GlobalSign%20nv-sa"},{"rsa":7,"ecc":4,"roots":11,"crtshUrl":"https://crt.sh/?CAName=IdenTrust%20Services%2C%20LLC"},{"rsa":4,"ecc":6,"roots":10,"crtshUrl":"https://crt.sh/?CAName=Google%20Trust%20Services%20LLC"},{"rsa":6,"ecc":4,"roots":10,"crtshUrl":"https://crt.sh/?CAName=Telia%20Company"},{"rsa":5,"ecc":4,"roots":9,"crtshUrl":"https://crt.sh/?CAName=Actalis"},{"rsa":4,"ecc":4,"roots":8,"crtshUrl":"https://crt.sh/?CAName=HARICA"},{"rsa":5,"ecc":2,"roots":7,"crtshUrl":"https://crt.sh/?CAName=Asseco%20Data%20Systems%20S.A."},{"rsa":4,"ecc":3,"roots":7,"crtshUrl":"https://crt.sh/?CAName=OISTE"},{"rsa":4,"ecc":2,"roots":6,"crtshUrl":"https://crt.sh/?CAName=Deutsche%20Telekom%20Security%20GmbH"},{"rsa":6,"ecc":0,"roots":6,"crtshUrl":"https://crt.sh/?CAName=GoDaddy"},{"rsa":3,"ecc":3,"roots":6,"crtshUrl":"https://crt.sh/?CAName=Microsec%20Ltd."},{"rsa":3,"ecc":3,"roots":6,"crtshUrl":"https://crt.sh/?CAName=TrustAsia%20Technologies%2C%20Inc."},{"rsa":3,"ecc":2,"roots":5,"crtshUrl":"https://crt.sh/?CAName=Amazon%20Trust%20Services"},{"rsa":3,"ecc":2,"roots":5,"crtshUrl":"https://crt.sh/?CAName=Atos"},{"rsa":3,"ecc":2,"roots":5,"crtshUrl":"https://crt.sh/?CAName=Prvn%C3%AD%20certifika%C4%8Dn%C3%AD%20autorita%2C%20a.s."},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=AC%20Camerfirma%2C%20S.A."},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Chunghwa%20Telecom"},{"rsa":3,"ecc":1,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Cybertrust%20Japan%20/%20JCSI"},{"rsa":2,"ecc":2,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20F%C3%A1brica%20Nacional%20de%20Moneda%20y%20Timbre%20%28FNMT%29"},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=SwissSign%20AG"},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Taiwan-CA%20Inc.%20%28TWCA%29"},{"rsa":3,"ecc":0,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Buypass"},{"rsa":3,"ecc":0,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Disig%2C%20a.s."},{"rsa":3,"ecc":0,"roots":3,"crtshUrl":"https://crt.sh/?CAName=e-commerce%20monitoring%20GmbH"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Finland%2C%20Population%20Register%20Centre%E2%80%99s%20%28V%C3%A4est%C3%B6rekisterikeskus%2C%20VRK%29"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Microsoft%20Corporation"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=NAVER%20Cloud%20Trust%20Services"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Visa"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=A-Trust"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificacion%20Firmaprofesional"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=BEIJING%20CERTIFICATE%20AUTHORITY%20Co.%2C%20Ltd."},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Certainly%20LLC"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Certigna"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=certSIGN"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=China%20Financial%20Certification%20Authority%20%28CFCA%29"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=DigitalSign%20-%20Certificadora%20Digital%2C%20S.A."},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Brazil%2C%20Instituto%20Nacional%20de%20Tecnologia%20da%20Informa%C3%A7%C3%A3o%20%28ITI%29"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Hong%20Kong%20%28SAR%29%2C%20Hongkong%20Post%2C%20Certizen"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20India%2C%20Ministry%20of%20Communications%20%26%20Information%20Technology%2C%20Controller%20of%20Certifying%20Authorities%20%28CCA%29"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Internet%20Security%20Research%20Group"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=iTrusChina%20Co.%2C%20Ltd."},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=LAWtrust"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Netlock"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Notarius"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Open%20Access%20Technology%20International%2C%20Inc.%20%28OATI%29"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Shanghai%20Electronic%20Certification%20Authority%20Co.%2C%20Ltd."},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Thailand%20National%20Root%20Certificate%20Authority%20%28Electronic%20Transactions%20Development%20Agency%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Agence%20Nationale%20de%20Certification%20Electronique"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificaci%C3%B3n%20%28ANF%20AC%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Carillon%20Information%20Security%20Inc."},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=ComSign"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Consejo%20General%20de%20la%20Abogac%C3%ADa%20Espa%C3%B1ola"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Consorci%20Administraci%C3%B3%20Oberta%20de%20Catalunya%20%28Consorci%20AOC%2C%20CATCert%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Department%20of%20Defence%20Australia"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Docaposte%20Certinomis%20SAS"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=EDICOM"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Financijska%20agencija%20%28Fina%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Global%20Digital%20Cybersecurity%20Authority%20Co.%2C%20Ltd.%20%28Formerly%20Guang%20Dong%20Certificate%20Authority%20%28GDCA%29%29"},{"rsa":0,"ecc":1,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Japan%2C%20Digital%20Agency"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Korea%2C%20KLID"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20Autoritat%20de%20Certificaci%C3%B3%20de%20la%20Comunitat%20Valenciana%20%28ACCV%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Sweden%20%28F%C3%B6rs%C3%A4kringskassan%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20The%20Netherlands%2C%20PKIoverheid%20%28Logius%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Turkey%2C%20Kamu%20Sertifikasyon%20Merkezi%20%28Kamu%20SM%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Halcom%20D.D."},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Izenpe%20S.A."},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Krajowa%20Izba%20Rozliczeniowa%20S.A.%20%28KIR%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Macao%20Post%20and%20Telecommunications%20Bureau"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=MULTICERT"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Netrust%20Pte%20Ltd"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=PostSignum"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Saudi%20Data%20and%20Artificial%20Intelligence%20Authority%20%28SDAIA%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=SI-TRUST"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Swiss%20BIT%2C%20Swiss%20Federal%20Office%20of%20Information%20Technology%2C%20Systems%20and%20Telecommunication%20%28FOITT%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=TrustFactory%28Pty%29Ltd"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Zetes"}],"lookupUrl":"https://crt.sh/?CAName={caOwner}","note":"Summary view. Full per-root detail in llm_snapshot_risk.json."},"distrustEvents":[{"ca":"DigiNotar","caOwner":"DigiNotar","crtshUrl":"https://crt.sh/?CAName=DigiNotar","year":2011,"country":"Netherlands","compliancePosture":"willful_circumvention","distrustPathway":"immediate","responseQuality":"moot","reasonTags":["infrastructure_compromise","rogue_certificate_issuance","concealed_breach_or_incident","certificates_used_for_mitm"],"summary":"CA infrastructure was fully compromised. Attacker issued 531+ fraudulent certificates including *.google.com, used in MITM surveillance of Iranian users. CA concealed the breach for weeks. Declared bankruptcy after distrust.","distrustDates":{"chrome":"2011-08-29","mozilla":"2011-09-02","apple":"2011-09-09","microsoft":"2011-09-13"},"classificationTier":"curated","postureEvidence":"Concealed breach for weeks while fraudulent certs were actively used for surveillance.","tagEvidence":{"infrastructure_compromise":"Curated from root program announcements","rogue_certificate_issuance":"Curated from root program announcements","concealed_breach_or_incident":"Curated from root program announcements","certificates_used_for_mitm":"Curated from root program announcements"},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2011-08-29","runwayDays":null},"references":{"rootProgramAnnouncements":["https://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/","https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-091511/"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/eFp_xmfNhAw"],"ccadbThreads":[],"articles":[{"url":"https://www.enisa.europa.eu/sites/default/files/all_files/Operation_Black_Tulip_v2.pdf","source":"ENISA","title":"Operation Black Tulip: Certificate authorities lose authority"},{"url":"https://www.theregister.com/2011/09/06/diginotar_audit_damning_fail/","source":"The Register","title":"Inside Operation Black Tulip: DigiNotar hack analysed"},{"url":"https://en.wikipedia.org/wiki/DigiNotar","source":"Wikipedia","title":"DigiNotar"},{"url":"https://digitalcommons.usf.edu/cgi/viewcontent.cgi?article=1246&context=jss","source":"Journal of Strategic Security","title":"DigiNotar: Dissecting the First Dutch Digital Disaster"}]}},{"ca":"ANSSI","caOwner":"Government of France (ANSSI, DCSSI)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20France%20%28ANSSI%2C%20DCSSI%29","year":2013,"country":"France","compliancePosture":"accidental","distrustPathway":"triggered","responseQuality":"cooperative","reasonTags":["unauthorized_delegation","rogue_certificate_issuance","certificates_used_for_mitm"],"summary":"Government CA issued intermediate certificate to network appliance company for traffic inspection. Used to issue MITM certificate for Google domains. ANSSI cooperated, certificate was revoked. Distrust limited to specific intermediate, not full root removal.","distrustDates":{"chrome":"2013-12-09","mozilla":"2013-12-09","apple":"2013-12-09","microsoft":"2013-12-09"},"classificationTier":"curated","postureEvidence":"Government CA delegated cert to network appliance company. Didn't understand WebPKI constraints on delegation.","tagEvidence":{"unauthorized_delegation":"Curated from root program announcements","rogue_certificate_issuance":"Curated from root program announcements","certificates_used_for_mitm":"Curated from root program announcements"},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2013-06-01","runwayDays":null},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2013/12/further-improving-digital-certificate.html","https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/"],"mdspThreads":[],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2013/12/further-improving-digital-certificate.html","source":"Chrome Blog","title":"Further improving digital certificate security"},{"url":"https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/","source":"Mozilla Blog","title":"Revoking trust in one ANSSI certificate"}]}},{"ca":"India CCA (NIC)","caOwner":"India CCA","crtshUrl":"https://crt.sh/?CAName=India%20CCA","year":2014,"country":"IN","compliancePosture":"negligent_noncompliance","distrustPathway":"triggered","responseQuality":"inadequate","reasonTags":["unauthorized_certificate","government_ca","lack_of_controls"],"summary":"Indian government CA (National Informatics Centre) issued unauthorized certificates for Google domains. Chrome, Mozilla, and Apple constrained or removed trust. Microsoft has not acted.","distrustDates":{"chrome":"2014-07-12","mozilla":"2014-07-14","apple":"2014-07-14"},"classificationTier":"curated","postureEvidence":"NIC intermediate CA issued unauthorized Google certificates.","tagEvidence":{},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2014-07-12","runwayDays":null}},{"ca":"CNNIC","caOwner":"China Internet Network Information Center (CNNIC)","crtshUrl":"https://crt.sh/?CAName=China%20Internet%20Network%20Information%20Center%20%28CNNIC%29","year":2015,"country":"China","compliancePosture":"negligent_noncompliance","distrustPathway":"triggered","responseQuality":"inadequate","reasonTags":["unauthorized_delegation","rogue_certificate_issuance","inadequate_incident_response","certificates_used_for_mitm"],"summary":"Issued unconstrained intermediate certificate to MCS Holdings, an Egyptian company that used it as a MITM proxy to issue unauthorized certificates for Google domains.","distrustDates":{"chrome":"2015-04-01","mozilla":"2015-04-02","apple":"2015-04-02","microsoft":"2015-04-02"},"classificationTier":"curated","postureEvidence":"Issued unconstrained intermediate to MCS Holdings without adequate oversight. MCS ran a MITM proxy.","tagEvidence":{"unauthorized_delegation":"Curated from root program announcements","rogue_certificate_issuance":"Curated from root program announcements","inadequate_incident_response":"Curated from root program announcements","certificates_used_for_mitm":"Curated from root program announcements"},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2015-04-01","runwayDays":null},"references":{"rootProgramAnnouncements":["https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/","https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Z5701nXiDqA"],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html","source":"Chrome Blog","title":"Maintaining digital certificate security"},{"url":"https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/","source":"Mozilla Blog","title":"Distrusting new CNNIC certificates"}]}},{"ca":"WoSign","caOwner":"WoSign CA Limited","crtshUrl":"https://crt.sh/?CAName=WoSign%20CA%20Limited","year":2016,"country":"China","compliancePosture":"willful_circumvention","distrustPathway":"immediate","responseQuality":"moot","reasonTags":["baseline_requirements_violations","rogue_certificate_issuance","active_deception","hidden_corporate_changes","validation_bypass"],"summary":"WoSign was distrusted for systematic rule circumvention including backdating SHA-1 certificates, issuing unauthorized certificates, and concealing their acquisition of StartCom. They deliberately built systems to violate browser restrictions and actively deceived the community about their operations.","distrustDates":{"chrome":"2016-10-31","mozilla":"2016-10-24","apple":"2016-12-01","microsoft":"2017-01-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2019-02-05","lastBugDate":"2019-02-05","distrustDate":"2016-06-01","runwayDays":-979},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/k9PBmyLCi8I","https://groups.google.com/g/mozilla.dev.security.policy/c/1XI3Y7PJ1Uc","https://groups.google.com/g/mozilla.dev.security.policy/c/BV5XyFJLnQM","https://groups.google.com/g/mozilla.dev.security.policy/c/VUj2glQYxLc"],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html","source":"Chrome Blog","title":"Distrusting WoSign and StartCom Certificates"},{"url":"https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/","source":"Mozilla Blog","title":"Distrusting New WoSign and StartCom Certificates"},{"url":"https://en.wikipedia.org/wiki/WoSign","source":"Wikipedia","title":"WoSign"}]}},{"ca":"StartCom","caOwner":"Start Commercial (StartCom) Ltd.","crtshUrl":"https://crt.sh/?CAName=Start%20Commercial%20%28StartCom%29%20Ltd.","year":2016,"country":"Israel","compliancePosture":"willful_circumvention","distrustPathway":"immediate","responseQuality":"moot","reasonTags":["active_deception","hidden_corporate_changes","rogue_certificate_issuance","baseline_requirements_violations","pattern_of_issues","validation_bypass"],"summary":"StartCom was distrusted for concealing its acquisition by WoSign while maintaining false appearance of independence. Post-distrust bugs show continued attempts to circumvent restrictions through proxy issuance and certificate manipulation, demonstrating willful violation of trust boundaries.","distrustDates":{"chrome":"2016-10-31","mozilla":"2016-10-24","apple":"2016-12-01","microsoft":"2017-01-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-03-25","lastBugDate":"2019-02-05","distrustDate":"2016-06-01","runwayDays":-297},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/TbDYE69YP8E"],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html","source":"Chrome Blog","title":"Distrusting WoSign and StartCom Certificates"},{"url":"https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/","source":"Mozilla Blog","title":"Distrusting New WoSign and StartCom Certificates"},{"url":"https://en.wikipedia.org/wiki/StartCom","source":"Wikipedia","title":"StartCom"}]}},{"ca":"Symantec","caOwner":"Symantec","crtshUrl":"https://crt.sh/?CAName=Symantec","year":2017,"country":"United States","compliancePosture":"argumentative_noncompliance","distrustPathway":"negotiated","responseQuality":"inadequate","reasonTags":["unauthorized_delegation","pattern_of_issues","validation_bypass","lack_of_meaningful_improvement","minimized_severity","baseline_requirements_violations","willful_misissuance"],"summary":"Google documented years of misissuance incidents including test certificates, non-audited intermediates, and BR violations. DigiCert acquired Symantec's CA business and managed the transition. Gradual distrust over 12+ months with subscriber migration.","distrustDates":{"chrome":"2018-04-17","mozilla":"2018-10-01","apple":"2018-10-15","microsoft":"2018-10-15"},"classificationTier":"curated","postureEvidence":"Third-party RA program was knowingly structured to bypass validation controls. Repeatedly minimized severity and argued rules should not apply as written. Willful misissuance in training infrastructure. Pattern of argumentative engagement with root programs eroded confidence.","tagEvidence":{"unauthorized_delegation":"Curated from root program announcements","pattern_of_issues":"Curated from root program announcements","validation_bypass":"Curated from root program announcements","lack_of_meaningful_improvement":"Curated from root program announcements","minimized_severity":"Curated from root program announcements","baseline_requirements_violations":"Curated from root program announcements"},"timeline":{"firstBugDate":"2017-01-27","lastBugDate":"2017-11-27","distrustDate":"2018-10-09","runwayDays":620},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/gLhzSzo-XFw"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4","https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html","source":"Chrome Blog","title":"Chrome's Plan to Distrust Symantec Certificates"},{"url":"https://arstechnica.com/information-technology/2017/03/google-takes-symantec-to-the-woodshed-for-mis-issuing-30000-https-certs/","source":"Ars Technica","title":"Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs"},{"url":"https://www.bleepingcomputer.com/news/security/google-outlines-ssl-apocalypse-for-symantec-certificates/","source":"Bleeping Computer","title":"Google Outlines SSL Apocalypse for Symantec Certificates"}]}},{"ca":"TurkTrust","caOwner":"TurkTrust","crtshUrl":"https://crt.sh/?CAName=TurkTrust","year":2018,"country":"Turkey","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","unauthorized_delegation","non_responsive_to_root_programs","audit_deficiencies","pattern_of_issues","rogue_certificate_issuance"],"summary":"TurkTrust was distrusted following a pattern of compliance failures including issuing non-audited, non-constrained intermediate certificates and failing to respond to root program surveys. The distrust was triggered by the 2012 incident where their operational mistake led to a fraudulent Google certificate, followed by ongoing compliance deficiencies.","distrustDates":{"chrome":"2018-06-01","mozilla":"2018-05-01","apple":"2018-06-01","microsoft":"2018-06-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-05-25","lastBugDate":"2018-02-17","distrustDate":"2018-06-01","runwayDays":372},"references":{"rootProgramAnnouncements":["https://krebsonsecurity.com/2013/01/turkish-registrar-enabled-phishers-to-spoof-google/"],"mdspThreads":[],"ccadbThreads":[],"articles":[{"url":"https://krebsonsecurity.com/2013/01/turkish-registrar-enabled-phishers-to-spoof-google/","source":"Krebs on Security","title":"Turkish CA enabled phishers to spoof Google"},{"url":"https://security.googleblog.com/2013/01/enhancing-digital-certificate-security.html","source":"Chrome Blog","title":"Enhancing digital certificate security"}]}},{"ca":"Certinomis","caOwner":"Docaposte Certinomis SAS","crtshUrl":"https://crt.sh/?CAName=Docaposte%20Certinomis%20SAS","year":2019,"country":"France","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","pattern_of_issues","lack_of_meaningful_improvement","inadequate_incident_response","non_responsive_to_root_programs"],"summary":"Certinomis was distrusted in 2019 following a sustained pattern of 20 documented incidents over 2+ years showing systematic BR violations including invalid DNS names, improper certificate profiles, and OCSP failures. Despite being aware of these issues through bug reports, the CA failed to implement effective systemic remediation, with the same violation categories recurring throughout the period.","distrustDates":{"chrome":"2019-07-01","mozilla":"2019-06-01","apple":"2019-07-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-02","lastBugDate":"2019-05-14","distrustDate":"2019-06-01","runwayDays":668},"references":{"rootProgramAnnouncements":["https://venafi.com/blog/mozilla-distrusts-certinomis-issued-certificates/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Ni4tS6OBBbw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/rmU311hOIIc"],"ccadbThreads":[],"articles":[{"url":"https://venafi.com/blog/mozilla-distrusts-certinomis-issued-certificates/","source":"Venafi","title":"Mozilla distrusts Certinomis issued certificates"}]}},{"ca":"PROCERT","caOwner":"PROCERT","crtshUrl":"https://crt.sh/?CAName=PROCERT","year":2020,"country":"Venezuela","compliancePosture":"demonstrated_incompetence","distrustPathway":"gradual","responseQuality":"non_responsive","reasonTags":["baseline_requirements_violations","non_responsive_to_root_programs","demonstrated_lack_of_understanding","limited_ecosystem_value"],"summary":"PROCERT was a Venezuelan CA that demonstrated incompetence through non-BR-compliant issuance and complete non-responsiveness to Mozilla's action items. The sparse 2017 bug trail with no CA engagement suggests an organization that lacked the operational capacity to participate meaningfully in the WebPKI ecosystem.","distrustDates":{"chrome":"2020-07-01","mozilla":"2020-06-01","apple":"2020-07-01","microsoft":"2020-07-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-16","lastBugDate":"2017-10-04","distrustDate":"2020-06-01","runwayDays":1020},"references":{"rootProgramAnnouncements":["https://venafi.com/blog/mozilla-distrusts-procert-local-certificate-authorities-have-global-impact/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Ni4tS6OBBbw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/lqZersN26VA"],"ccadbThreads":[],"articles":[{"url":"https://venafi.com/blog/mozilla-distrusts-procert-local-certificate-authorities-have-global-impact/","source":"Venafi","title":"Mozilla distrusts PROCERT: local CAs have global impact"}]}},{"ca":"Camerfirma","caOwner":"AC Camerfirma, S.A.","crtshUrl":"https://crt.sh/?CAName=AC%20Camerfirma%2C%20S.A.","year":2021,"country":"Spain","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","pattern_of_issues","lack_of_meaningful_improvement","unauthorized_delegation","audit_deficiencies","inadequate_incident_response"],"summary":"Camerfirma was distrusted after years of systematic Baseline Requirements violations, delayed revocations, and unauthorized subordinate CA issuance. Despite repeated incidents and Mozilla oversight, the CA failed to implement effective controls, with the same types of violations recurring over multiple years.","distrustDates":{"chrome":"2021-07-01","mozilla":"2021-06-01","apple":"2021-07-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-03-25","lastBugDate":"2021-04-09","distrustDate":"2021-06-01","runwayDays":1529},"references":{"rootProgramAnnouncements":["https://www.theregister.com/2021/02/02/chrome_camerfirma_certificates/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Ni4tS6OBBbw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/dSeD3dgnpzk"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4"],"articles":[{"url":"https://www.theregister.com/2021/02/02/chrome_camerfirma_certificates/","source":"The Register","title":"Chrome and Mozilla distrust Camerfirma certificates"}]}},{"ca":"TrustCor","caOwner":"TrustCor Systems","crtshUrl":"https://crt.sh/?CAName=TrustCor%20Systems","year":2022,"country":"Canada","compliancePosture":"negligent_noncompliance","distrustPathway":"immediate","responseQuality":"cooperative","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","audit_deficiencies","ties_to_adversarial_entities","pattern_of_issues"],"summary":"TrustCor was distrusted in 2022 primarily due to discovered corporate ties to surveillance entities rather than the technical compliance issues shown in these 2019 Bugzilla reports. While they had routine compliance problems and delayed revocations, the fundamental issue was organizational trust incompatibility.","distrustDates":{"chrome":"2022-12-02","mozilla":"2022-12-01","apple":"2022-12-02","microsoft":"2023-02-28"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2019-03-04","lastBugDate":"2019-11-26","distrustDate":"2022-06-01","runwayDays":1185},"references":{"rootProgramAnnouncements":["https://www.ghacks.net/2022/12/02/mozilla-and-microsoft-distrust-trustcor-root-certificates-in-their-browsers/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4","https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://www.ghacks.net/2022/12/02/mozilla-and-microsoft-distrust-trustcor-root-certificates-in-their-browsers/","source":"gHacks","title":"Mozilla and Microsoft distrust TrustCor root certificates"},{"url":"https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-browser-mozilla/","source":"Washington Post","title":"TrustCor linked to intelligence operations"}]}},{"ca":"Visa","caOwner":"Visa","crtshUrl":"https://crt.sh/?CAName=Visa","year":2022,"country":"United States of America","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"non_responsive","reasonTags":["baseline_requirements_violations","audit_deficiencies","non_responsive_to_root_programs","pattern_of_issues","limited_ecosystem_value"],"summary":"Visa demonstrated a pattern of BR violations and audit deficiencies from 2017-2020 while completely failing to engage with root programs or respond to identified issues. The CA showed no meaningful participation in the WebPKI ecosystem it was supposed to serve.","distrustDates":{"chrome":"2022-07-01","mozilla":"2022-06-01","apple":"2022-07-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-16","lastBugDate":"2020-07-07","distrustDate":"2022-06-01","runwayDays":1750},"references":{"rootProgramAnnouncements":["https://www.feistyduck.com/newsletter/issue_45_visa_certificate_authority_in_trouble"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/yqALPG5PC4s","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/wOAsjdGla9g"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://www.feistyduck.com/newsletter/issue_45_visa_certificate_authority_in_trouble","source":"Feisty Duck","title":"Visa Certificate Authority in trouble"}]}},{"ca":"e-Tugra","caOwner":"E-Tugra","crtshUrl":"https://crt.sh/?CAName=E-Tugra","year":2023,"country":"Turkey","compliancePosture":"demonstrated_incompetence","distrustPathway":"triggered","responseQuality":"inadequate","reasonTags":["operational_security_failures","baseline_requirements_violations","pattern_of_issues","inadequate_incident_response","demonstrated_lack_of_understanding","non_responsive_to_root_programs","limited_ecosystem_value"],"summary":"E-Tugra was distrusted after security researcher Ian Carroll discovered severe operational security failures including default passwords and exposed administrative interfaces. The CA had a 4-year pattern of baseline requirements violations but the security research findings triggered immediate distrust action.","distrustDates":{"chrome":"2023-01-09","mozilla":"2023-01-16","apple":"2023-01-16","microsoft":"2023-03-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2018-02-17","lastBugDate":"2022-11-18","distrustDate":"2023-06-01","runwayDays":1930},"references":{"rootProgramAnnouncements":["https://ian.sh/etugra"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://ian.sh/etugra","source":"Ian Carroll","title":"Security research findings on e-Tugra"}]}},{"ca":"Ecommerce Monitoring","caOwner":"e-commerce monitoring GmbH","crtshUrl":"https://crt.sh/?CAName=e-commerce%20monitoring%20GmbH","year":2024,"country":"Austria","compliancePosture":"demonstrated_incompetence","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","inadequate_incident_response","demonstrated_lack_of_understanding","pattern_of_issues","lack_of_meaningful_improvement"],"summary":"Ecommerce Monitoring demonstrated fundamental operational incompetence through a sustained pattern of baseline requirements violations and delayed revocations spanning 2021-2024. Most notably, when asked for root cause analysis of incidents, they confused the investigative concept with their root certificate, revealing they didn't understand basic CA operational requirements.","distrustDates":{"chrome":"2024-07-01","mozilla":"2024-06-01","apple":"2024-07-01","microsoft":"2024-07-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2021-06-12","lastBugDate":"2024-05-17","distrustDate":"2024-06-01","runwayDays":1085},"references":{"rootProgramAnnouncements":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/HFMEAMUe7v4/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/HFMEAMUe7v4/"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/wRs-zec8w7k","https://groups.google.com/a/ccadb.org/g/public/c/GmGydKS2lMA","https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4"],"articles":[{"url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/HFMEAMUe7v4/","source":"MDSP","title":"Ecommerce Monitoring removal discussion"}]}},{"ca":"Entrust","caOwner":"Entrust","crtshUrl":"https://crt.sh/?CAName=Entrust","year":2024,"country":"United States of America","compliancePosture":"argumentative_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","argued_rules_dont_apply","recharacterized_incidents","minimized_severity","lack_of_meaningful_improvement","pattern_of_issues","inadequate_incident_response"],"summary":"Entrust demonstrated a multi-year pattern of baseline requirements violations, delayed revocations, and argumentative responses that prioritized justifying non-compliance over fixing issues. Chrome explicitly noted Entrust's pattern of arguing that established practices should not apply to their circumstances rather than taking responsibility for mistakes.","distrustDates":{"chrome":"2024-11-12","apple":"2024-11-15","mozilla":"2025-03-01","microsoft":"2025-04-16"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-16","lastBugDate":"2024-04-06","distrustDate":"2024-11-11","runwayDays":2644},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/LhTIUMFGHNw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/jCvkhBjg9Yw"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/79fkkAXMLpY","https://groups.google.com/a/ccadb.org/g/public/c/YhpAYN5lRh0","https://groups.google.com/a/ccadb.org/g/public/c/tk2CV6Mc-xo"],"articles":[{"url":"https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html","source":"Chrome Blog","title":"Sustaining Digital Certificate Security"},{"url":"https://arstechnica.com/security/2025/06/chrome-boots-2-certificate-authorities-citing-a-lack-of-trust-and-confidence/","source":"Ars Technica","title":"Chrome boots certificate authorities citing lack of trust and confidence"},{"url":"https://www.theregister.com/2024/08/01/mozilla_entrust/","source":"The Register","title":"Mozilla follows Google in distrusting Entrust's TLS certs"},{"url":"https://blog.cloudflare.com/how-cloudflare-is-helping-domain-owners-with-the-upcoming-entrust-ca/","source":"Cloudflare Blog","title":"How Cloudflare is helping domain owners with the Entrust distrust"}]}}],"distrustStats":{"totalEvents":16,"postureDistribution":{"willful_circumvention":3,"accidental":1,"negligent_noncompliance":7,"argumentative_noncompliance":2,"demonstrated_incompetence":3},"avgIntervalYears":0.93,"avgIntervalMonths":11,"medianRunwayDays":1185,"maxRunwayDays":2644,"avgRunwayDays":1280,"responseDrivenPct":73},"governance":{"reportCard":{"chrome":{"enforcement":"15/15","firstPublicAction":7,"neverActed":0,"stillTrusts":0,"bugzillaCoverage":722,"bugzillaCoverageRecent":283,"substantiveOversight":290,"substantiveOversightRecent":109,"oversightComments":1934,"ballotsProposed":16,"voteParticipation":"9/14","substantiveBallots":12,"caOwners":45,"roots":105,"exclusiveRoots":0,"ungoverned_exclusive":0},"mozilla":{"enforcement":"15/15","firstPublicAction":8,"neverActed":0,"stillTrusts":0,"bugzillaCoverage":816,"bugzillaCoverageRecent":271,"substantiveOversight":249,"substantiveOversightRecent":47,"oversightComments":1802,"ballotsProposed":18,"voteParticipation":"14/14","substantiveBallots":15,"caOwners":50,"roots":171,"exclusiveRoots":10,"ungoverned_exclusive":2},"apple":{"enforcement":"15/15","firstPublicAction":0,"neverActed":0,"stillTrusts":0,"bugzillaCoverage":45,"bugzillaCoverageRecent":45,"substantiveOversight":6,"substantiveOversightRecent":6,"oversightComments":64,"ballotsProposed":11,"voteParticipation":"10/14","substantiveBallots":9,"caOwners":39,"roots":144,"exclusiveRoots":4,"ungoverned_exclusive":0},"microsoft":{"enforcement":"11/15","firstPublicAction":0,"neverActed":4,"stillTrusts":4,"bugzillaCoverage":0,"bugzillaCoverageRecent":0,"substantiveOversight":0,"substantiveOversightRecent":0,"oversightComments":0,"ballotsProposed":0,"voteParticipation":"4/14","substantiveBallots":6,"caOwners":77,"roots":331,"exclusiveRoots":158,"ungoverned_exclusive":30}},"meta":{"bugsTotal":1787,"bugsWithComments":1787,"totalCommentsAnalyzed":6144},"bugCreationByYear":[{"y":2014,"chrome":0,"mozilla":2,"apple":0,"microsoft":0,"other":1},{"y":2015,"chrome":0,"mozilla":0,"apple":0,"microsoft":0,"other":1},{"y":2016,"chrome":0,"mozilla":3,"apple":0,"microsoft":0,"other":2},{"y":2017,"chrome":0,"mozilla":83,"apple":0,"microsoft":0,"other":40},{"y":2018,"chrome":3,"mozilla":59,"apple":0,"microsoft":0,"other":46},{"y":2019,"chrome":18,"mozilla":61,"apple":6,"microsoft":2,"other":168},{"y":2020,"chrome":28,"mozilla":20,"apple":3,"microsoft":3,"other":183},{"y":2021,"chrome":6,"mozilla":16,"apple":2,"microsoft":8,"other":155},{"y":2022,"chrome":0,"mozilla":10,"apple":4,"microsoft":0,"other":92},{"y":2023,"chrome":6,"mozilla":8,"apple":2,"microsoft":0,"other":117},{"y":2024,"chrome":3,"mozilla":5,"apple":0,"microsoft":1,"other":227},{"y":2025,"chrome":0,"mozilla":2,"apple":1,"microsoft":5,"other":215},{"y":2026,"chrome":0,"mozilla":0,"apple":9,"microsoft":10,"other":151}],"bugCreationTotals":{"chrome":64,"mozilla":269,"apple":27,"microsoft":29,"other":1398},"discoveryMethods":{"totals":{"external_researcher":300,"unknown":448,"community":276,"self_detected":386,"audit":125,"root_program":65},"by_year":[{"y":2014,"self_detected":0,"external_researcher":1,"root_program":0,"community":0,"audit":0,"unknown":2,"total":3},{"y":2015,"self_detected":0,"external_researcher":0,"root_program":0,"community":1,"audit":0,"unknown":0,"total":1},{"y":2016,"self_detected":0,"external_researcher":1,"root_program":0,"community":3,"audit":0,"unknown":1,"total":5},{"y":2017,"self_detected":13,"external_researcher":52,"root_program":1,"community":21,"audit":3,"unknown":9,"total":99},{"y":2018,"self_detected":13,"external_researcher":22,"root_program":12,"community":19,"audit":0,"unknown":20,"total":86},{"y":2019,"self_detected":25,"external_researcher":58,"root_program":4,"community":43,"audit":9,"unknown":74,"total":213},{"y":2020,"self_detected":8,"external_researcher":45,"root_program":4,"community":51,"audit":9,"unknown":91,"total":208},{"y":2021,"self_detected":16,"external_researcher":31,"root_program":4,"community":32,"audit":14,"unknown":67,"total":164},{"y":2022,"self_detected":15,"external_researcher":23,"root_program":7,"community":17,"audit":3,"unknown":34,"total":99},{"y":2023,"self_detected":23,"external_researcher":24,"root_program":10,"community":18,"audit":8,"unknown":46,"total":129},{"y":2024,"self_detected":82,"external_researcher":17,"root_program":3,"community":39,"audit":10,"unknown":54,"total":205},{"y":2025,"self_detected":101,"external_researcher":13,"root_program":12,"community":16,"audit":52,"unknown":25,"total":219},{"y":2026,"self_detected":90,"external_researcher":13,"root_program":8,"community":16,"audit":17,"unknown":25,"total":169}],"classified_bugs":1600,"excluded_distrusted":187,"corpus_note":"1600 bugs classified (excludes 187 distrusted-CA bugs). Corpus is larger than the 1,428-incident count in incidents.json because discovery classification runs on all non-distrusted bugs_raw entries, including ~75 sub-operator naming variants (e.g. 'DigiCert / ABB') that incidents.py normalizes into parent CA counts."},"programCommentSummary":{"chrome":{"total_comments":2118,"substantive_comments":2118,"workflow_events":0,"admin_comments":124,"oversight_comments":1934,"recent_oversight_comments":643,"technical_oversight_comments":614,"recent_technical_oversight_comments":210,"self_incident_comments":60,"recent_self_incident_comments":30,"bugs_engaged":738,"bugs_oversight":722,"recent_bugs_oversight":283,"bugs_technical_oversight":290,"recent_bugs_technical_oversight":109},"mozilla":{"total_comments":3258,"substantive_comments":3257,"workflow_events":1,"admin_comments":1455,"oversight_comments":1802,"recent_oversight_comments":439,"technical_oversight_comments":453,"recent_technical_oversight_comments":77,"self_incident_comments":0,"recent_self_incident_comments":0,"bugs_engaged":816,"bugs_oversight":816,"recent_bugs_oversight":271,"bugs_technical_oversight":249,"recent_bugs_technical_oversight":47},"apple":{"total_comments":201,"substantive_comments":201,"workflow_events":0,"admin_comments":3,"oversight_comments":64,"recent_oversight_comments":64,"technical_oversight_comments":11,"recent_technical_oversight_comments":11,"self_incident_comments":134,"recent_self_incident_comments":77,"bugs_engaged":63,"bugs_oversight":45,"recent_bugs_oversight":45,"bugs_technical_oversight":6,"recent_bugs_technical_oversight":6},"microsoft":{"total_comments":568,"substantive_comments":568,"workflow_events":0,"admin_comments":2,"oversight_comments":0,"recent_oversight_comments":0,"technical_oversight_comments":0,"recent_technical_oversight_comments":0,"self_incident_comments":566,"recent_self_incident_comments":513,"bugs_engaged":45,"bugs_oversight":0,"recent_bugs_oversight":0,"bugs_technical_oversight":0,"recent_bugs_technical_oversight":0}},"oversightConcentration":{"chrome":{"total_oversight_comments":1934,"unique_contributors":6,"top_contributor_pct":87,"top_3_contributors_pct":97,"top_contributor_email":"r**********@gmail.com","top_contributor_first_quarter":"2014-Q1","top_contributor_last_quarter":"2022-Q2"},"mozilla":{"total_oversight_comments":1802,"unique_contributors":9,"top_contributor_pct":47,"top_3_contributors_pct":90,"top_contributor_email":"w******@fastly.com","top_contributor_first_quarter":"2017-Q4","top_contributor_last_quarter":"2020-Q2"},"apple":{"total_oversight_comments":64,"unique_contributors":2,"top_contributor_pct":64,"top_3_contributors_pct":100,"top_contributor_email":"d**********@apple.com","top_contributor_first_quarter":"2025-Q4","top_contributor_last_quarter":"2026-Q3"},"microsoft":{"total_oversight_comments":0,"unique_contributors":0,"top_contributor_pct":0,"top_3_contributors_pct":0,"top_contributor_email":null,"top_contributor_first_quarter":null,"top_contributor_last_quarter":null}},"oversightQuarterly":[{"quarter":"2014-Q1","chrome_comments":3,"chrome_people":1,"mozilla_comments":2,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2015-Q3","chrome_comments":0,"chrome_people":0,"mozilla_comments":2,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2016-Q2","chrome_comments":0,"chrome_people":0,"mozilla_comments":2,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2016-Q3","chrome_comments":0,"chrome_people":0,"mozilla_comments":4,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2016-Q4","chrome_comments":2,"chrome_people":1,"mozilla_comments":2,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q1","chrome_comments":2,"chrome_people":1,"mozilla_comments":14,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q2","chrome_comments":1,"chrome_people":1,"mozilla_comments":22,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q3","chrome_comments":122,"chrome_people":1,"mozilla_comments":102,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q4","chrome_comments":37,"chrome_people":1,"mozilla_comments":139,"mozilla_people":4,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q1","chrome_comments":7,"chrome_people":1,"mozilla_comments":107,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q2","chrome_comments":13,"chrome_people":1,"mozilla_comments":92,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q3","chrome_comments":4,"chrome_people":1,"mozilla_comments":50,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q4","chrome_comments":15,"chrome_people":1,"mozilla_comments":60,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q1","chrome_comments":155,"chrome_people":1,"mozilla_comments":144,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q2","chrome_comments":121,"chrome_people":1,"mozilla_comments":122,"mozilla_people":4,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q3","chrome_comments":207,"chrome_people":1,"mozilla_comments":134,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q4","chrome_comments":113,"chrome_people":1,"mozilla_comments":77,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q1","chrome_comments":125,"chrome_people":1,"mozilla_comments":75,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q2","chrome_comments":95,"chrome_people":1,"mozilla_comments":83,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q3","chrome_comments":222,"chrome_people":2,"mozilla_comments":88,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q4","chrome_comments":47,"chrome_people":1,"mozilla_comments":42,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q1","chrome_comments":62,"chrome_people":1,"mozilla_comments":41,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q2","chrome_comments":156,"chrome_people":1,"mozilla_comments":29,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q3","chrome_comments":119,"chrome_people":1,"mozilla_comments":32,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q4","chrome_comments":36,"chrome_people":2,"mozilla_comments":12,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q1","chrome_comments":16,"chrome_people":1,"mozilla_comments":18,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q2","chrome_comments":11,"chrome_people":1,"mozilla_comments":15,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q3","chrome_comments":6,"chrome_people":2,"mozilla_comments":11,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q4","chrome_comments":11,"chrome_people":2,"mozilla_comments":11,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q1","chrome_comments":9,"chrome_people":2,"mozilla_comments":12,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q2","chrome_comments":22,"chrome_people":2,"mozilla_comments":10,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q3","chrome_comments":3,"chrome_people":2,"mozilla_comments":27,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q4","chrome_comments":4,"chrome_people":2,"mozilla_comments":19,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q1","chrome_comments":14,"chrome_people":2,"mozilla_comments":14,"mozilla_people":1,"apple_comments":1,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q2","chrome_comments":39,"chrome_people":2,"mozilla_comments":48,"mozilla_people":1,"apple_comments":17,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q3","chrome_comments":13,"chrome_people":2,"mozilla_comments":33,"mozilla_people":1,"apple_comments":3,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q4","chrome_comments":19,"chrome_people":3,"mozilla_comments":33,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q1","chrome_comments":20,"chrome_people":3,"mozilla_comments":40,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q2","chrome_comments":30,"chrome_people":2,"mozilla_comments":9,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q3","chrome_comments":22,"chrome_people":1,"mozilla_comments":9,"mozilla_people":1,"apple_comments":2,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q4","chrome_comments":11,"chrome_people":1,"mozilla_comments":1,"mozilla_people":1,"apple_comments":14,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2026-Q1","chrome_comments":14,"chrome_people":1,"mozilla_comments":9,"mozilla_people":1,"apple_comments":25,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2026-Q2","chrome_comments":5,"chrome_people":1,"mozilla_comments":3,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2026-Q3","chrome_comments":1,"chrome_people":1,"mozilla_comments":3,"mozilla_people":1,"apple_comments":2,"apple_people":1,"microsoft_comments":0,"microsoft_people":0}],"enforcement":{"chrome":{"acted":15,"total":15,"initiated":7,"followed":8,"still_trusts":[]},"mozilla":{"acted":15,"total":15,"initiated":8,"followed":7,"still_trusts":[]},"apple":{"acted":15,"total":15,"initiated":0,"followed":15,"still_trusts":[]},"microsoft":{"acted":11,"total":15,"initiated":0,"followed":11,"still_trusts":["India CCA (NIC)","Certinomis","Camerfirma","Visa"]}},"distrustEvents":[{"ca":"DigiNotar","year":2011,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"ANSSI","year":2013,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"India CCA (NIC)","year":2014,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"CNNIC","year":2015,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"WoSign / StartCom","year":2016,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Symantec","year":2017,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"TurkTrust","year":2018,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Certinomis","year":2019,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"PROCERT","year":2020,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Camerfirma","year":2021,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"TrustCor","year":2022,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Visa","year":2022,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"e-Tugra","year":2023,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Ecommerce Monitoring","year":2024,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Entrust","year":2024,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"}],"storePosture":{"mozilla":{"owners":50,"roots":171,"exclusive_count":10,"gov_ca_count":15,"dark_matter":{"exclusive_cas":2,"exclusive_zero_incident":2,"zero_incident_cas":14,"total_cas":57,"exclusive_zero_pct":100.0,"zero_incident_pct":24.6}},"microsoft":{"owners":77,"roots":331,"exclusive_count":158,"gov_ca_count":29,"dark_matter":{"exclusive_cas":32,"exclusive_zero_incident":30,"zero_incident_cas":42,"total_cas":84,"exclusive_zero_pct":93.8,"zero_incident_pct":50.0}},"chrome":{"owners":45,"roots":105,"exclusive_count":0,"gov_ca_count":14,"dark_matter":{"exclusive_cas":0,"exclusive_zero_incident":0,"zero_incident_cas":10,"total_cas":51,"exclusive_zero_pct":0.0,"zero_incident_pct":19.6}},"apple":{"owners":39,"roots":144,"exclusive_count":4,"gov_ca_count":10,"dark_matter":{"exclusive_cas":0,"exclusive_zero_incident":0,"zero_incident_cas":10,"total_cas":45,"exclusive_zero_pct":0.0,"zero_incident_pct":22.2}}},"policyLeadership":{"by_working_group":{"server_certificate":{"programs":{"chrome":{"proposed":14,"endorsed":16,"voted":9,"absent":5,"ballots_with_votes":14},"mozilla":{"proposed":15,"endorsed":21,"voted":14,"absent":0,"ballots_with_votes":14},"apple":{"proposed":7,"endorsed":14,"voted":10,"absent":4,"ballots_with_votes":14},"microsoft":{"proposed":0,"endorsed":9,"voted":4,"absent":10,"ballots_with_votes":14}},"total_ballots":101,"prefix":"SC"},"code_signing":{"programs":{"chrome":{"proposed":0,"endorsed":0,"voted":0,"absent":1,"ballots_with_votes":1},"mozilla":{"proposed":0,"endorsed":0,"voted":0,"absent":1,"ballots_with_votes":1},"apple":{"proposed":0,"endorsed":1,"voted":0,"absent":1,"ballots_with_votes":1},"microsoft":{"proposed":6,"endorsed":12,"voted":1,"absent":0,"ballots_with_votes":1}},"total_ballots":35,"prefix":"CSC"},"smime":{"programs":{"chrome":{"proposed":0,"endorsed":1,"voted":1,"absent":13,"ballots_with_votes":14},"mozilla":{"proposed":0,"endorsed":5,"voted":14,"absent":0,"ballots_with_votes":14},"apple":{"proposed":0,"endorsed":4,"voted":8,"absent":6,"ballots_with_votes":14},"microsoft":{"proposed":0,"endorsed":0,"voted":1,"absent":13,"ballots_with_votes":14}},"total_ballots":18,"prefix":"SMC"},"network_security":{"programs":{"chrome":{"proposed":2,"endorsed":6,"voted":0,"absent":0,"ballots_with_votes":0},"mozilla":{"proposed":3,"endorsed":4,"voted":0,"absent":0,"ballots_with_votes":0},"apple":{"proposed":4,"endorsed":7,"voted":0,"absent":0,"ballots_with_votes":0},"microsoft":{"proposed":0,"endorsed":3,"voted":0,"absent":0,"ballots_with_votes":0}},"total_ballots":20,"prefix":"NS"}},"recent_votes":[{"id":"SC-095","title":"Ballot SC095v3: Clean-up 2025","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-097","title":"Ballot SC097: Sunset all remaining use of SHA-1 signatures in Certificates and CRLs","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"yes"},{"id":"SC-094","title":"Ballot SC094v2: DNSSEC exception in email DCV methods","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-096","title":"Ballot SC096: Carve-out for DNSSEC verification logging requirements","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-090","title":"Ballot SC-090: Gradually sunset all remaining email-based, phone-based, and \u2018crossover\u2019 validation methods from Sections 3.2.2.4 and 3.2.2.5","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-091","title":"Ballot SC-091: Sunset 3.2.2.5.3 Reverse Address Lookup Validation, proposal of new DNS-based validation using Persistent DCV TXT Record for IP addresses","result":"passed","chrome":"yes","mozilla":"yes","apple":"absent","microsoft":"absent"},{"id":"SC-086","title":"Ballot SC-086v3: Sunset the Inclusion of IP Reverse Address Domain Names","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-088","title":"Ballot SC-088v3: DNS TXT Record with Persistent Value DCV Method","result":"passed","chrome":"yes","mozilla":"yes","apple":"absent","microsoft":"absent"},{"id":"SC-092","title":"Ballot SC-092: Sunset use of Precertificate Signing CAs","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-089","title":"Ballot SC-089: Mass Revocation Planning","result":"passed","chrome":"absent","mozilla":"yes","apple":"absent","microsoft":"yes"},{"id":"SC-085","title":"Ballot SC-085v2: Require Validation of DNSSEC (when present) for CAA and DCV Lookups","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-081","title":"Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"yes"},{"id":"SC-084","title":"Ballot SC084: DNS Labeled with ACME Account ID Validation Method","result":"passed","chrome":"yes","mozilla":"yes","apple":"absent","microsoft":"yes"},{"id":"SC-083","title":"Ballot SC083v3: Winter 2024-2025 Cleanup Ballot","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"}],"total_sc_ballots":101,"programs":{"chrome":{"proposed":16,"endorsed":22,"voted":9,"absent":5,"ballots_with_votes":14,"vote_participation_pct":64},"mozilla":{"proposed":18,"endorsed":25,"voted":14,"absent":0,"ballots_with_votes":14,"vote_participation_pct":100},"apple":{"proposed":11,"endorsed":21,"voted":10,"absent":4,"ballots_with_votes":14,"vote_participation_pct":71},"microsoft":{"proposed":0,"endorsed":12,"voted":4,"absent":10,"ballots_with_votes":14,"vote_participation_pct":29}}},"ballotClassification":{"total_ballots":174,"recent_count":50,"substantive_ballots":104,"pct_substantive":60,"browser_summary":{"chrome":{"total":16,"substantive":12,"pct_substantive":75,"endorsed":22,"by_category":{"uncategorized":3,"validation_improvement":3,"security_modernization":3,"transparency_profiles":3,"infrastructure":3,"cleanup":1}},"mozilla":{"total":18,"substantive":15,"pct_substantive":83,"endorsed":30,"by_category":{"incident_response":3,"governance":1,"security_modernization":2,"infrastructure":5,"validation_improvement":3,"transparency_profiles":2,"cleanup":1,"uncategorized":1}},"apple":{"total":11,"substantive":9,"pct_substantive":82,"endorsed":24,"by_category":{"validation_improvement":3,"security_modernization":1,"audit_standards":1,"infrastructure":4,"uncategorized":2}},"microsoft":{"total":6,"substantive":6,"pct_substantive":100,"endorsed":24,"by_category":{"security_modernization":1,"validation_improvement":4,"infrastructure":1}}},"top_ca_contributors":[{"name":"DigiCert","total":60,"substantive":29,"pct_substantive":48,"endorsed":39,"by_category":{"security_modernization":3,"cleanup":9,"incident_response":3,"uncategorized":8,"governance":14,"infrastructure":6,"transparency_profiles":5,"validation_improvement":10,"audit_standards":2}},{"name":"HARICA","total":14,"substantive":8,"pct_substantive":57,"endorsed":29,"by_category":{"validation_improvement":2,"transparency_profiles":2,"governance":3,"infrastructure":4,"uncategorized":1,"cleanup":2}},{"name":"Other CA","total":13,"substantive":5,"pct_substantive":38,"endorsed":0,"by_category":{"cleanup":5,"uncategorized":1,"validation_improvement":4,"governance":2,"infrastructure":1}},{"name":"Sectigo","total":10,"substantive":6,"pct_substantive":60,"endorsed":18,"by_category":{"infrastructure":3,"cleanup":3,"transparency_profiles":1,"uncategorized":1,"validation_improvement":1,"incident_response":1}},{"name":"Entrust","total":10,"substantive":3,"pct_substantive":30,"endorsed":22,"by_category":{"transparency_profiles":2,"uncategorized":5,"cleanup":2,"infrastructure":1}},{"name":"TrustCor","total":5,"substantive":5,"pct_substantive":100,"endorsed":8,"by_category":{"infrastructure":5}},{"name":"GlobalSign","total":5,"substantive":5,"pct_substantive":100,"endorsed":11,"by_category":{"validation_improvement":4,"security_modernization":1}},{"name":"Let's Encrypt","total":4,"substantive":1,"pct_substantive":25,"endorsed":4,"by_category":{"cleanup":2,"governance":1,"incident_response":1}},{"name":"SecureTrust","total":2,"substantive":0,"pct_substantive":0,"endorsed":0,"by_category":{"cleanup":2}}],"category_totals":{"security_modernization":{"browsers":7,"cas":4,"total":11},"validation_improvement":{"browsers":13,"cas":21,"total":34},"incident_response":{"browsers":3,"cas":5,"total":8},"transparency_profiles":{"browsers":5,"cas":10,"total":15},"infrastructure":{"browsers":13,"cas":20,"total":33},"cleanup":{"browsers":2,"cas":25,"total":27},"governance":{"browsers":1,"cas":20,"total":21},"audit_standards":{"browsers":1,"cas":2,"total":3},"uncategorized":{"browsers":6,"cas":16,"total":22}},"recent":{"total_ballots":50,"substantive_ballots":31,"browser_summary":{"chrome":{"total":9,"substantive":6,"pct_substantive":67,"endorsed":9,"by_category":{"uncategorized":3,"validation_improvement":3,"security_modernization":2,"transparency_profiles":1}},"mozilla":{"total":4,"substantive":3,"pct_substantive":75,"endorsed":15,"by_category":{"incident_response":2,"governance":1,"security_modernization":1}},"apple":{"total":7,"substantive":6,"pct_substantive":86,"endorsed":11,"by_category":{"validation_improvement":3,"security_modernization":1,"audit_standards":1,"infrastructure":1,"uncategorized":1}},"microsoft":{"total":0,"substantive":0,"pct_substantive":0,"endorsed":5,"by_category":{}}},"top_ca_contributors":[{"name":"Other CA","total":6,"substantive":3,"pct_substantive":50,"endorsed":0,"by_category":{"cleanup":1,"uncategorized":1,"validation_improvement":3,"governance":1}},{"name":"Sectigo","total":6,"substantive":3,"pct_substantive":50,"endorsed":7,"by_category":{"infrastructure":2,"cleanup":3,"transparency_profiles":1}},{"name":"DigiCert","total":5,"substantive":3,"pct_substantive":60,"endorsed":10,"by_category":{"security_modernization":2,"cleanup":1,"incident_response":1,"uncategorized":1}},{"name":"HARICA","total":4,"substantive":4,"pct_substantive":100,"endorsed":13,"by_category":{"validation_improvement":2,"transparency_profiles":2}},{"name":"Let's Encrypt","total":4,"substantive":1,"pct_substantive":25,"endorsed":2,"by_category":{"cleanup":2,"governance":1,"incident_response":1}},{"name":"Entrust","total":3,"substantive":2,"pct_substantive":67,"endorsed":3,"by_category":{"transparency_profiles":2,"uncategorized":1}},{"name":"SecureTrust","total":2,"substantive":0,"pct_substantive":0,"endorsed":0,"by_category":{"cleanup":2}}],"category_totals":{"security_modernization":{"browsers":4,"cas":2,"total":6},"validation_improvement":{"browsers":6,"cas":5,"total":11},"incident_response":{"browsers":2,"cas":2,"total":4},"transparency_profiles":{"browsers":1,"cas":5,"total":6},"infrastructure":{"browsers":1,"cas":2,"total":3},"cleanup":{"browsers":0,"cas":9,"total":9},"governance":{"browsers":1,"cas":2,"total":3},"audit_standards":{"browsers":1,"cas":0,"total":1},"uncategorized":{"browsers":4,"cas":3,"total":7}}}},"notableGaps":{"current":[{"ca":"TrustAsia Technologies, Inc.","rank":12,"certs":944539,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["apple","microsoft"],"included_in":["chrome","mozilla"],"wait_years":5,"wait_source":"root_creation"},{"ca":"Certainly LLC","rank":15,"certs":140922,"stores":{"chrome":"included","mozilla":"included","apple":"included","microsoft":"not_included"},"missing_from":["microsoft"],"included_in":["chrome","mozilla","apple"],"wait_years":5,"wait_source":"root_creation"},{"ca":"Cybertrust Japan Co., Ltd.","rank":23,"certs":34358,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","apple"],"included_in":["mozilla","microsoft"],"wait_years":null,"wait_source":null},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","rank":24,"certs":30500,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Open Access Technology International, Inc. (OATI)","rank":36,"certs":2471,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":18,"wait_source":"root_creation"},{"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","rank":37,"certs":2366,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":9,"wait_source":"root_creation"},{"ca":"PostSignum","rank":44,"certs":991,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","rank":46,"certs":509,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":10,"wait_source":"root_creation"},{"ca":"Krajowa Izba Rozliczeniowa S.A. (KIR)","rank":47,"certs":453,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Prvn\u00ed certifika\u010dn\u00ed autorita, a.s.","rank":49,"certs":352,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Financijska agencija (Fina)","rank":50,"certs":307,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","rank":51,"certs":214,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":4,"wait_source":"root_creation"},{"ca":"A-Trust","rank":54,"certs":147,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Visa","rank":56,"certs":110,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":21,"wait_source":"root_creation"},{"ca":"Agence Nationale de Certification Electronique","rank":57,"certs":77,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":7,"wait_source":"root_creation"},{"ca":"EDICOM","rank":58,"certs":43,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":12,"wait_source":"root_creation"},{"ca":"Government of Korea, KLID","rank":59,"certs":38,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":3,"wait_source":"root_creation"},{"ca":"Netlock","rank":60,"certs":13,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":18,"wait_source":"root_creation"},{"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","rank":61,"certs":13,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["apple","microsoft"],"included_in":["chrome","mozilla"],"wait_years":7,"wait_source":"root_creation"},{"ca":"iTrusChina Co., Ltd.","rank":62,"certs":12,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["apple","microsoft"],"included_in":["chrome","mozilla"],"wait_years":8,"wait_source":"root_creation"},{"ca":"BEIJING CERTIFICATE AUTHORITY Co., Ltd.","rank":64,"certs":9,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["chrome","apple","microsoft"],"included_in":["mozilla"],"wait_years":7,"wait_source":"root_creation"},{"ca":"Cybertrust Japan / JCSI","rank":65,"certs":2,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","apple"],"included_in":["mozilla","microsoft"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Entrust","rank":67,"certs":0,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"included","microsoft":"included"},"missing_from":["chrome","mozilla"],"included_in":["apple","microsoft"],"wait_years":16,"wait_source":"root_creation"},{"ca":"AC Camerfirma, S.A.","rank":81,"certs":0,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":18,"wait_source":"root_creation"},{"ca":"Consorci Administraci\u00f3 Oberta de Catalunya (Consorci AOC, CATCert)","rank":90,"certs":0,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":23,"wait_source":"root_creation"}],"distrust_divergences":[{"ca":"India CCA (NIC)","year":2014,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"chrome"},{"ca":"Certinomis","year":2019,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"mozilla"},{"ca":"Camerfirma","year":2021,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"mozilla"},{"ca":"Visa","year":2022,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"mozilla"}],"historical":[{"ca":"Internet Security Research Group","common_name":"Let's Encrypt","rank":1,"certs_now":591742571,"timeline":{"root_created":"2015-06","mozilla_included":"2016-08","microsoft_included":"2018-08","apple_included":"2018-12"},"gap_years":2,"gap_description":"2-year gap between first inclusion (Mozilla Aug 2016) and Apple/Microsoft (late 2018). Relied on IdenTrust cross-sign.","resolved":true}]},"inclusionVelocity":{"mozilla_pending":[{"bug":1348774,"ca":"Thailand National Root CAs - G2 and G3","filed":"2017-03-20","days_waiting":3407,"stage":"verifying","request_type":"existing_ca"},{"bug":1449941,"ca":"Fina Root CA certificate","filed":"2018-03-29","days_waiting":3033,"stage":"unknown","request_type":"new_org"},{"bug":1532206,"ca":"MSC Trustgate root certificate(s)","filed":"2019-03-04","days_waiting":2693,"stage":"verifying","request_type":"new_org"},{"bug":1602415,"ca":"PostSignum Root QCA 4 and PostSignum Root QCA ECC R1","filed":"2019-12-09","days_waiting":2413,"stage":"verifying","request_type":"existing_ca"},{"bug":1674669,"ca":"Autoridade Certificadora Raiz Brasileira root certificate","filed":"2020-11-01","days_waiting":2085,"stage":"unknown","request_type":"existing_ca"},{"bug":1707136,"ca":"GSE SMIME Roots to Mozilla root store","filed":"2021-04-23","days_waiting":1912,"stage":"verifying","request_type":"new_org"},{"bug":1845081,"ca":"MOIS SSL Root CA","filed":"2023-07-24","days_waiting":1090,"stage":"unknown","request_type":"new_org"},{"bug":1870013,"ca":"Saudi National SSL root CA","filed":"2023-12-14","days_waiting":947,"stage":"initial","request_type":"existing_ca"},{"bug":1883983,"ca":"SOLUTI GLOBAL ROOT CA","filed":"2024-03-06","days_waiting":864,"stage":"initial","request_type":"new_org"},{"bug":1889859,"ca":"emSign Single-purpose Root CA Certificates","filed":"2024-04-05","days_waiting":834,"stage":"cps-review","request_type":"new_org"},{"bug":1938884,"ca":"NAVER Cloud Trust Services Root Certificates","filed":"2024-12-23","days_waiting":572,"stage":"verifying","request_type":"existing_ca"},{"bug":1948085,"ca":"Amazon EU Roots: RSA 2048 EU M1, ECDSA 256 EU M1, and ECDSA ","filed":"2025-02-13","days_waiting":520,"stage":"verifying","request_type":"existing_ca"},{"bug":1960408,"ca":"IdenTrust single purpose roots","filed":"2025-04-14","days_waiting":460,"stage":"verifying","request_type":"existing_ca"},{"bug":1978904,"ca":"NETLOCK's S/MIME & TLS Root","filed":"2025-07-23","days_waiting":360,"stage":"initial","request_type":"new_org"},{"bug":1983217,"ca":"Aretiico Group PLC and Aretiico Inc root certificates to Moz","filed":"2025-08-15","days_waiting":337,"stage":"initial","request_type":"existing_ca"},{"bug":1988341,"ca":"ACCV ROOT RSA TLS 2024 and ACCV ROOT ECC TLS 2024 root certi","filed":"2025-09-12","days_waiting":309,"stage":"verifying","request_type":"new_org"},{"bug":1988361,"ca":"SHECA Single-purpose Root CA Certificates","filed":"2025-09-12","days_waiting":309,"stage":"verifying","request_type":"new_org"},{"bug":1990213,"ca":"certSIGN Root CA G4 root certificate","filed":"2025-09-23","days_waiting":298,"stage":"verifying","request_type":"existing_ca"},{"bug":1992971,"ca":"Actalis TLS Root CAs 2025 and Actalis SMIME Root CAs 2025","filed":"2025-10-07","days_waiting":284,"stage":"verifying","request_type":"existing_ca"},{"bug":2001274,"ca":"Cybertrust Japan Root CA Cybertrust iTrust TLS ECCP384 Root ","filed":"2025-11-20","days_waiting":240,"stage":"initial","request_type":"existing_ca"},{"bug":2001275,"ca":"Cybertrust Japan Root CA Cybertrust iTrust TLS RSA4096 Root ","filed":"2025-11-20","days_waiting":240,"stage":"initial","request_type":"existing_ca"},{"bug":2007765,"ca":"Chunghwa Telecom CHT TrustRoot CA","filed":"2025-12-26","days_waiting":204,"stage":"initial","request_type":"existing_ca"},{"bug":2011714,"ca":"\"OATI webCARES Server Root CA\" to the Mozilla Root CA Progra","filed":"2026-01-21","days_waiting":178,"stage":"initial","request_type":"new_org"},{"bug":2031847,"ca":"FNMT TLS RSA Root Certificate SERVIDORES SEGUROS G2R","filed":"2026-04-14","days_waiting":95,"stage":"initial","request_type":"new_org"},{"bug":2033449,"ca":"A-Trust SMIME Root","filed":"2026-04-20","days_waiting":89,"stage":"initial","request_type":"existing_ca"},{"bug":2033676,"ca":"National Certification Authority of Sri Lanka TLS Root CA - ","filed":"2026-04-21","days_waiting":88,"stage":"initial","request_type":"new_org"},{"bug":2033815,"ca":"Disig new S/MIME & TLS Roots","filed":"2026-04-21","days_waiting":88,"stage":"initial","request_type":"new_org"},{"bug":2035858,"ca":"GoDaddy and Starfield TLS R1 Root Certificates","filed":"2026-04-29","days_waiting":80,"stage":"initial","request_type":"existing_ca"},{"bug":2037054,"ca":"Certum TLS RSA Root CA and Certum TLS ECC Root CA","filed":"2026-05-05","days_waiting":74,"stage":"initial","request_type":"new_org"},{"bug":2046825,"ca":"KIR single-purpose TLS and SMIME Root CA's","filed":"2026-06-11","days_waiting":37,"stage":"initial","request_type":"new_org"}],"mozilla_completed_recent":[{"bug":1658793,"ca":"Cybertrust Japan SecureSign Roots (CA12, CA14 and CA15)","filed":"2020-08-12","resolved":"2025-01-24","days":1626,"request_type":"existing_ca"},{"bug":1647181,"ca":"BJCA root certificate(s)","filed":"2020-06-22","resolved":"2023-05-11","days":1053,"request_type":"new_org"},{"bug":1688854,"ca":"TrustAsia root certificates","filed":"2021-01-26","resolved":"2023-11-30","days":1038,"request_type":"existing_ca"},{"bug":1627552,"ca":"e-commerce monitoring's GLOBALTRUST 2020 root certificate","filed":"2020-04-05","resolved":"2022-11-14","days":953,"request_type":"existing_ca"},{"bug":1628720,"ca":"E-Tugra Root Certificates RSA v3 / ECC v3","filed":"2020-04-09","resolved":"2022-11-14","days":949,"request_type":"new_org"},{"bug":1637269,"ca":"GlobalSign SMIME Roots to Mozilla root store","filed":"2020-05-12","resolved":"2022-11-14","days":916,"request_type":"existing_ca"},{"bug":1710831,"ca":"LAWtrust Root CA2 to NSS","filed":"2021-05-12","resolved":"2023-08-01","days":811,"request_type":"existing_ca"},{"bug":1664161,"ca":"Telia CA root certificate","filed":"2020-09-10","resolved":"2022-11-14","days":795,"request_type":"existing_ca"},{"bug":1873057,"ca":"Microsec \"e-Szigno TLS Root CA 2023\"","filed":"2024-01-04","resolved":"2026-02-18","days":776,"request_type":"existing_ca"},{"bug":1675821,"ca":"Re-Signed GTS Roots","filed":"2020-11-06","resolved":"2022-11-14","days":738,"request_type":"new_org"},{"bug":1845047,"ca":"SwissSign RSA TLS Root CA 2022 - 1 and SwissSign RSA SMIME R","filed":"2023-07-24","resolved":"2025-07-12","days":719,"request_type":"existing_ca"},{"bug":1918570,"ca":"SECOM SMIME RSA Root CA 2024","filed":"2024-09-13","resolved":"2026-07-15","days":670,"request_type":"existing_ca"},{"bug":1785215,"ca":"\"FIRMAPROFESIONAL CA ROOT-A WEB\" Root Certificate","filed":"2022-08-17","resolved":"2024-06-10","days":663,"request_type":"new_org"},{"bug":1694421,"ca":"DigitalSign's root certificates","filed":"2021-02-23","resolved":"2022-11-14","days":629,"request_type":"new_org"},{"bug":1836258,"ca":"D-TRUST BR Root CA 2 2023 and D-TRUST EV Root CA 2 2023","filed":"2023-06-01","resolved":"2025-02-18","days":628,"request_type":"existing_ca"},{"bug":1695487,"ca":"HARICA 2021 TLS Root CA Certificates to Mozilla Root store p","filed":"2021-02-28","resolved":"2022-11-14","days":624,"request_type":"existing_ca"},{"bug":1695486,"ca":"HARICA 2021 SMIME Root CA Certificates to Mozilla Root store","filed":"2021-02-28","resolved":"2022-11-14","days":624,"request_type":"existing_ca"},{"bug":1925173,"ca":"Cybertrust Japan SecureSign Root CA16","filed":"2024-10-17","resolved":"2026-06-15","days":606,"request_type":"existing_ca"},{"bug":1763177,"ca":"Commscope Root Certificates","filed":"2022-04-05","resolved":"2023-11-28","days":602,"request_type":"new_org"},{"bug":1706228,"ca":"DigiCert root Certificates","filed":"2021-04-20","resolved":"2022-11-14","days":573,"request_type":"existing_ca"},{"bug":1781510,"ca":"D-Trust SBR Root CAs 1 & 2 2022","filed":"2022-07-26","resolved":"2024-02-01","days":555,"request_type":"existing_ca"},{"bug":1943001,"ca":"SECOM TLS RSA Root CA 2024 and SECOM TLS ECC Root CA 2024","filed":"2025-01-22","resolved":"2026-07-15","days":539,"request_type":"existing_ca"},{"bug":1799533,"ca":"SSL.com 2022 TLS Root CA Certificates","filed":"2022-11-07","resolved":"2024-03-15","days":494,"request_type":"existing_ca"},{"bug":1720400,"ca":"Actalis intermediate certs to OneCRL","filed":"2021-07-13","resolved":"2022-11-14","days":489,"request_type":"existing_ca"},{"bug":1727941,"ca":"Certainly R1 and E1 Root Certificates","filed":"2021-08-27","resolved":"2022-11-14","days":444,"request_type":"existing_ca"},{"bug":1968852,"ca":"Telia Company's S/MIME & TLS Roots","filed":"2025-05-28","resolved":"2026-07-15","days":413,"request_type":"existing_ca"},{"bug":1849702,"ca":"Taiwan-CA Inc. (TWCA) root certificates","filed":"2023-08-22","resolved":"2024-09-13","days":388,"request_type":"existing_ca"},{"bug":1782092,"ca":"Atos Roots","filed":"2022-07-28","resolved":"2023-08-01","days":369,"request_type":"existing_ca"},{"bug":1820592,"ca":"Telekom Security Root Certificates","filed":"2023-03-06","resolved":"2024-02-16","days":347,"request_type":"existing_ca"},{"bug":1936279,"ca":"OISTE root certificates","filed":"2024-12-10","resolved":"2025-11-19","days":344,"request_type":"existing_ca"},{"bug":1929329,"ca":"TrustAsia Dedicated Roots","filed":"2024-11-05","resolved":"2025-09-27","days":326,"request_type":"existing_ca"},{"bug":1799703,"ca":"SSL.com 2022 Client Root CA Certificates","filed":"2022-11-08","resolved":"2023-08-01","days":266,"request_type":"existing_ca"},{"bug":1817340,"ca":"Sectigo R46/E46 Roots","filed":"2023-02-16","resolved":"2023-08-14","days":179,"request_type":"existing_ca"}],"mozilla_stats":{"pending_count":30,"completed_count":33,"median_days":624,"mean_days":641,"max_days":1626,"longest_pending_days":3407,"new_org":{"count":6,"median_days":700,"mean_days":772,"max_days":1053,"pending_count":15,"longest_pending_days":3033},"existing_ca":{"count":27,"median_days":573,"mean_days":612,"max_days":1626,"pending_count":15,"longest_pending_days":3407}},"note":"Mozilla only \u2014 only root program with a fully public inclusion pipeline (Bugzilla)."},"coverageRateByYear":[{"y":2014,"total_bugs":3,"chrome":33.3,"mozilla":33.3,"apple":0.0,"microsoft":0.0},{"y":2015,"total_bugs":1,"chrome":0.0,"mozilla":100.0,"apple":0.0,"microsoft":0.0},{"y":2016,"total_bugs":5,"chrome":20.0,"mozilla":80.0,"apple":0.0,"microsoft":0.0},{"y":2017,"total_bugs":123,"chrome":49.6,"mozilla":86.2,"apple":0.0,"microsoft":0.0},{"y":2018,"total_bugs":108,"chrome":16.7,"mozilla":82.4,"apple":0.0,"microsoft":0.0},{"y":2019,"total_bugs":255,"chrome":67.8,"mozilla":78.0,"apple":0.0,"microsoft":0.0},{"y":2020,"total_bugs":237,"chrome":66.2,"mozilla":49.4,"apple":0.0,"microsoft":0.0},{"y":2021,"total_bugs":187,"chrome":58.3,"mozilla":30.5,"apple":0.0,"microsoft":0.0},{"y":2022,"total_bugs":106,"chrome":22.6,"mozilla":28.3,"apple":0.0,"microsoft":0.0},{"y":2023,"total_bugs":133,"chrome":15.0,"mozilla":27.1,"apple":0.0,"microsoft":0.0},{"y":2024,"total_bugs":236,"chrome":22.5,"mozilla":32.2,"apple":5.9,"microsoft":0.0},{"y":2025,"total_bugs":223,"chrome":18.4,"mozilla":9.9,"apple":5.4,"microsoft":0.0},{"y":2026,"total_bugs":170,"chrome":7.6,"mozilla":5.3,"apple":7.6,"microsoft":0.0}]},"ecosystemParticipation":{"meta":{"generated_at":"2026-07-18T08:13:59.229110+00:00","pipeline_version":"1.1","total_orgs":62,"total_cabf_ca_members":56,"total_individuals":134,"total_ballots":174,"note_technical":"technical_comments counts LLM-classified substantive comments (cert/CRL analysis, specific BR citations, investigative questions). Values may exceed bugs_engaged since multiple technical comments per bug are counted.","note_baseline":"All CABF CA members included as org rows, even those with zero engagement. cabf_member=true indicates formal membership. Absence of engagement by a member is as meaningful as presence."},"cabfMemberCount":56,"activeMemberCount":21,"zeroContributionCount":35,"topOrganizations":[{"name":"Sectigo","cabfMember":true,"bugzillaEngaged":134,"ballotsProposed":9,"ballotsEndorsed":18,"bugsFiled":13},{"name":"DigiCert","cabfMember":true,"bugzillaEngaged":31,"ballotsProposed":60,"ballotsEndorsed":38,"bugsFiled":0},{"name":"HARICA","cabfMember":true,"bugzillaEngaged":53,"ballotsProposed":16,"ballotsEndorsed":29,"bugsFiled":0},{"name":"Let's Encrypt","cabfMember":true,"bugzillaEngaged":60,"ballotsProposed":2,"ballotsEndorsed":2,"bugsFiled":0},{"name":"iSigma","cabfMember":false,"bugzillaEngaged":17,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":7},{"name":"Entrust","cabfMember":true,"bugzillaEngaged":0,"ballotsProposed":9,"ballotsEndorsed":20,"bugsFiled":0},{"name":"Certainly/Fastly","cabfMember":true,"bugzillaEngaged":5,"ballotsProposed":5,"ballotsEndorsed":6,"bugsFiled":0},{"name":"GlobalSign","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":5,"ballotsEndorsed":11,"bugsFiled":0},{"name":"TrustCor Systems","cabfMember":false,"bugzillaEngaged":0,"ballotsProposed":5,"ballotsEndorsed":8,"bugsFiled":0},{"name":"SwissSign","cabfMember":true,"bugzillaEngaged":6,"ballotsProposed":0,"ballotsEndorsed":4,"bugsFiled":0},{"name":"SSL.com","cabfMember":true,"bugzillaEngaged":4,"ballotsProposed":1,"ballotsEndorsed":3,"bugsFiled":0},{"name":"Amazon Trust Services","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":2,"ballotsEndorsed":5,"bugsFiled":0},{"name":"Cisco","cabfMember":false,"bugzillaEngaged":0,"ballotsProposed":2,"ballotsEndorsed":1,"bugsFiled":0},{"name":"Chunghwa Telecom","cabfMember":true,"bugzillaEngaged":2,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":0},{"name":"Certum/Asseco","cabfMember":true,"bugzillaEngaged":0,"ballotsProposed":1,"ballotsEndorsed":0,"bugsFiled":0},{"name":"Telia","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":1,"bugsFiled":0},{"name":"Certinomis","cabfMember":false,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":0},{"name":"PKIoverheid","cabfMember":false,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":0}],"topBallotIndividuals":[{"name":"Stephen Davidson","proposed":36,"endorsed":1},{"name":"Dimitris Zacharopoulos","proposed":15,"endorsed":28},{"name":"Tim Hollebeek","proposed":9,"endorsed":20},{"name":"Bruce Morton","proposed":6,"endorsed":20},{"name":"Martijn Katerbarg","proposed":8,"endorsed":13},{"name":"Corey Bonnell","proposed":8,"endorsed":10},{"name":"Doug Beattie","proposed":5,"endorsed":6},{"name":"Ben Wilson","proposed":4,"endorsed":2},{"name":"Dean Coclin","proposed":3,"endorsed":3},{"name":"Neil Dunbar","proposed":2,"endorsed":6},{"name":"Daniel Jeffery","proposed":3,"endorsed":2},{"name":"Dunbar","proposed":3,"endorsed":2},{"name":"Wayne Thayer","proposed":2,"endorsed":4},{"name":"Aaron Gable","proposed":2,"endorsed":2},{"name":"Ben Slaughter","proposed":2,"endorsed":1}],"individualCount":134},"regulatorySurface":{"currentYear":2026,"totalObligations":6664,"mandatory":5056,"recommended":629,"optional":979,"mandatoryPct":76,"baselineYear":2000,"baselineTotal":55,"growthMultiple":121,"sourceTotals":{"cabfForum":2792,"rootPrograms":537,"auditIetf":1972,"regulatory":761},"tlsBr":{"v1_0_total":278,"current_total":1275,"operational":573,"profileSpec":702},"ballots":{"total":0,"since2022":0,"byDoc":{}},"timeSeries":[{"y":2000,"t":55,"m":40},{"y":2001,"t":55,"m":40},{"y":2002,"t":55,"m":40},{"y":2003,"t":55,"m":40},{"y":2004,"t":286,"m":218},{"y":2005,"t":286,"m":218},{"y":2006,"t":286,"m":218},{"y":2007,"t":286,"m":218},{"y":2008,"t":883,"m":576},{"y":2009,"t":883,"m":576},{"y":2010,"t":883,"m":576},{"y":2011,"t":883,"m":576},{"y":2012,"t":1216,"m":838},{"y":2013,"t":1249,"m":856},{"y":2014,"t":1249,"m":856},{"y":2015,"t":1552,"m":1084},{"y":2016,"t":1594,"m":1114},{"y":2017,"t":1655,"m":1167},{"y":2018,"t":1850,"m":1306},{"y":2019,"t":2257,"m":1563},{"y":2020,"t":2627,"m":1933},{"y":2021,"t":3821,"m":2832},{"y":2022,"t":3980,"m":2942},{"y":2023,"t":4533,"m":3401},{"y":2024,"t":6562,"m":4981},{"y":2025,"t":6698,"m":5086},{"y":2026,"t":6664,"m":5056}],"methodology":""},"tabIntros":{"generatedAt":"2026-07-18T08:31:55.546151+00:00","model":"claude-sonnet-4-5","note":"Analyst summaries generated by Claude from the prior day's snapshot. Each paragraph states the key finding for that tab with specific numbers and connects to related tabs.","intros":{"market":"The WebPKI market shows moderate concentration with five CAs controlling 92% of issuance. Internet Security Research Group leads at 40%, followed by Google Trust Services at 19% and DigiCert at 14%. The HHI of 2347 indicates a moderately concentrated market, while 75 CAs operate in the long tail with minimal issuance share. Despite consolidation at the top, 89 trusted CAs remain active in trust stores.","trust":"335 roots are distributed across the four major trust stores, but only 90 roots appear in all four programs simultaneously. Microsoft maintains 142 roots not trusted by Chrome, Mozilla, or Apple, creating the largest source of cross-store disagreement. 38 CA owners have presence in all four stores, but per-store root counts vary significantly. These disagreements force CAs to maintain multiple validation chains and create operational complexity where a certificate chain trusted in Edge may fail verification in Chrome or Safari.","conc":"Market concentration creates systemic dependency risk, with the top three CAs controlling 72% of all issuance. A failure at Internet Security Research Group alone would affect two in five HTTPS connections globally. The CR5 ratio of 92% means just five organizations underpin nearly the entire encrypted web. This concentration amplifies the impact of incidents at major CAs, as seen in the 1,511 total incidents recorded across the ecosystem.","tail":"75 CAs operate with minimal market share yet retain full inclusion in major trust stores, creating asymmetric risk exposure. These low-volume issuers collectively represent less than 8% of certificates but account for a disproportionate share of incidents and governance failures. Many tail CAs lack the operational maturity of high-volume providers, yet a compromise or misissuance event at any trusted CA can affect all relying parties. The long tail also complicates root program oversight, as governance resources must scale across 89 active CAs regardless of issuance volume.","geo":"US-based CAs issue 90% of all trusted certificates despite representing only 15 of 89 active CAs. European CAs account for 44 of the 89 trusted issuers but control just 10% of issuance, while Asia-Pacific's 17 CAs produce only 0.07% of certificates. This geographic concentration means a single regulatory or legal event in the United States could affect nine in ten HTTPS connections worldwide. The disparity between CA count and issuance share highlights how trust store presence does not translate to market success, particularly outside North America.","gov":"30 government-operated or state-owned CAs hold positions in major trust stores but collectively issue only 0.06% of public certificates. These entities appear primarily in Microsoft's trust store, which maintains the broadest and least selective inclusion policy. State-controlled CAs present unique risks as they operate under legal frameworks that may prioritize national security or surveillance over browser security requirements. Despite minimal issuance share, their trust store presence grants them the technical capability to issue for any domain, making them a persistent counter-party risk in the WebPKI.","jurisdiction":"Five jurisdictions are classified as high-risk for compelled disclosure or interception: China, Russia, United Kingdom, Australia, and Hong Kong. India and Turkey represent moderate risk based on legal frameworks enabling government access to private key material or surveillance infrastructure. CAs incorporated in these countries face legal obligations that may conflict with browser security requirements, particularly around disclosure of compromises or government key access. The geographic concentration of 90% issuance in the United States means US legal frameworks governing lawful access and national security letters affect the majority of the WebPKI.","ops":"1,511 incidents have been recorded across 54 CAs, with misissuance accounting for 588 events and governance failures for 476. Only 24% of incidents are discovered through CA self-detection, while 19% come from external researchers and 17% from automated tools. Root programs themselves identify just 4% of issues despite their governance authority. Policy failures appear in 175 incidents, disclosure failures in 132, and audit findings in 107, revealing that required controls frequently fail to prevent or detect problems before they reach production systems.","crypto":"Root certificate cryptographic posture varies across the 335 trusted roots, with legacy algorithms and key sizes still present in active trust stores. The transition from SHA-1 and 1024-bit RSA has largely completed for leaf certificates, but older roots remain trusted to maintain backwards compatibility with existing intermediate and subscriber certificates. Standards compliance is enforced through BR requirements and root program policies, though the audit intelligence data shows that 30% in-period detection rate suggests gaps between stated cryptographic requirements and actual verification. The upcoming BR readiness deadlines will force another round of infrastructure updates as maximum validity periods compress from 398 days toward 47 days by 2029.","distrust":"16 distrust events have occurred across the ecosystem, with 14 attributed to compliance or operational failures rather than malicious intent. Negligent noncompliance accounts for seven posture classifications, demonstrated incompetence for three, and willful circumvention for three. The median runway between distrust announcement and effective date is 1,185 days, though this extended timeline reflects browser programs balancing ecosystem disruption against security requirements. Pattern-of-issues findings appear in 10 distrust cases, indicating that single incidents rarely trigger removal but accumulated failures eventually exhaust root program patience.","policy":"Certificate validity readiness shows 11 of 40 active TLS CAs already issuing at or below the 47-day target that becomes mandatory in March 2029, while 6 remain above the 100-day threshold that takes effect in March 2027. Median actual certificate use stands at 63 days, well below the current 200-day limit. This operational readiness coexists with explosive compliance complexity, as CAs now navigate 6,664 total obligations across baseline requirements, root programs, and standards bodies. The regulatory surface has grown 121-fold since 2000, with 76% of obligations now mandatory rather than recommended, yet zero ballots have passed since 2022 to streamline or consolidate these requirements.","governance":"Root program oversight coverage has collapsed from 68-78% in 2019 to just 18% for Chrome and 10% for Mozilla in 2025. Chrome commented substantively on 109 of 223 incident bugs in recent periods, while Mozilla engaged on 47 and Apple on 6. Microsoft provided zero substantive oversight comments despite maintaining the largest trust store with 142 exclusive roots. This governance gap means the majority of incidents now proceed without root program input, leaving CAs to self-interpret requirements. The declining oversight rate coincides with the surge in compliance obligations documented in BR readiness, creating a feedback loop where expanding requirements receive diminishing authoritative guidance.","community":"56 organizations hold CA/Browser Forum membership but only 21 contribute actively to standards development. 35 members maintain zero contribution records, effectively operating as observers rather than participants. Stephen Davidson leads ballot activity with 36 proposals, while Sectigo ranks as the most active organizational contributor. This participation gap means a small minority of CAs define requirements that bind the entire ecosystem, including the silent majority who implement but do not shape policy. The concentration of ballot leadership among high-volume CAs may explain why BR readiness obligations have grown 121-fold while streamlining efforts stall at zero ballots since 2022.","audit":"Auditors caught 30% of in-scope incidents in their audit letters, meaning 70% of real operational failures coexisted with clean annual attestations. 37 CAs show high transparency gaps between audit period end dates and public letter availability, while 6 received qualified opinions indicating material control deficiencies. 77 audit letters have been parsed from 83 CAs, with self-reported qualifications appearing in 59% of WebTrust and 66% of ETSI letters. KPMG audits 10 CAs with average transparency gaps of 100 days, while BDO serves 6 CAs with 51% average quality scores. 13 CAs changed auditors in 2025, potentially indicating opinion shopping or cost pressure, and only 7 CAs have adopted the stricter ETSI EN 319 411-1 v3.5 standard that raises evidence requirements."}},"auditIntelligence":{"generatedAt":"2026-07-18T08:11:07.045683Z","summary":{"totalCAOwners":83,"parsedLetters":77,"highTransparencyGap":37,"qualifiedOpinions":6,"mattersWithoutBzAnchor":8,"auditorHHI":526.9,"auditRecordStatus":{"named":83,"extractable":0,"lapsed":0,"no_record":0},"stalenessDistribution":{"aging":33,"current":22,"stale":22,"very_stale":6}},"frameworkStats":{"WebTrust":49,"ETSI":34},"selfReportByFramework":{"webTrust":58.5,"etsi":65.6},"inPeriodDetection":{"covered":404,"caught":120,"multiCycleMisses":49,"detectionPct":29.7,"note":"Denominator = unique bugs with at least one covering audit period. Caught = mentioned in any covering letter."},"perAuditorDetection":[{"auditor":"MATRIX Ltd.","caught":11,"total":11,"detectionPct":100.0},{"auditor":"T\u00dcV NORD","caught":3,"total":3,"detectionPct":100.0},{"auditor":"TayllorCox PCEB","caught":3,"total":3,"detectionPct":100.0},{"auditor":"PwC","caught":12,"total":13,"detectionPct":92.3},{"auditor":"Anthony Kam & Associates Ltd.","caught":6,"total":7,"detectionPct":85.7},{"auditor":"Deloitte","caught":5,"total":7,"detectionPct":71.4},{"auditor":"SunRise CPAs / DFK","caught":5,"total":10,"detectionPct":50.0},{"auditor":"LSTI","caught":7,"total":15,"detectionPct":46.7},{"auditor":"T\u00dcV Austria","caught":7,"total":18,"detectionPct":38.9},{"auditor":"T\u00dcViT","caught":2,"total":8,"detectionPct":25.0},{"auditor":"datenschutz cert GmbH","caught":1,"total":4,"detectionPct":25.0},{"auditor":"BDO International","caught":38,"total":157,"detectionPct":24.2},{"auditor":"Ernst & Young","caught":14,"total":66,"detectionPct":21.2},{"auditor":"Schellman","caught":4,"total":20,"detectionPct":20.0},{"auditor":"KPMG","caught":2,"total":48,"detectionPct":4.2},{"auditor":"DEKRA","caught":0,"total":9,"detectionPct":0.0},{"auditor":"BDO Consulting (Malaysia)","caught":0,"total":7,"detectionPct":0.0},{"auditor":"Certop Informatikai Tan\u00fas\u00edt\u00e1si Szolg\u00e1ltat\u00e1sok Kft.","caught":0,"total":6,"detectionPct":0.0},{"auditor":"Scott S. Perry CPA, PLLC","caught":0,"total":32,"detectionPct":0.0},{"auditor":"AENOR","caught":0,"total":8,"detectionPct":0.0},{"auditor":"Crowe FST Audit Ltd","caught":0,"total":6,"detectionPct":0.0},{"auditor":"QMSCERT","caught":0,"total":4,"detectionPct":0.0},{"auditor":"QSCert","caught":0,"total":8,"detectionPct":0.0}],"alvEquivalentFindings":{"parsedLetters":77,"missingRootFingerprints":0,"certificateScopeGaps":7,"accurateFingerprintCoverage":0,"untracedRoots":5,"missingFingerprintsPct":0,"scopeGapsPct":9},"perAuditorAlvFindings":[{"auditor":"LSTI","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Ernst & Young","clients":5,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"KPMG","clients":9,"missingFingerprintsPct":0,"scopeGapPct":11},{"auditor":"TayllorCox PCEB","clients":5,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Deloitte","clients":8,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"A-SIT","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"AENOR","clients":4,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Auren","clients":2,"missingFingerprintsPct":0,"scopeGapPct":50},{"auditor":"CSQA Certificazioni","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Schellman","clients":3,"missingFingerprintsPct":0,"scopeGapPct":33},{"auditor":"BDO International","clients":6,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"QMSCERT","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"SunRise CPAs / DFK","clients":5,"missingFingerprintsPct":0,"scopeGapPct":40},{"auditor":"T\u00dcV NORD","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"datenschutz cert GmbH","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0}],"qualifiedOpinions":[{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","stores":["microsoft"],"auditor":"KPMG"},{"ca":"Entrust","stores":["apple","microsoft"],"auditor":"Deloitte"},{"ca":"e-commerce monitoring GmbH","stores":["microsoft"],"auditor":"A-SIT"},{"ca":"Microsoft Corporation","stores":["apple","chrome","microsoft","mozilla"],"auditor":"Deloitte"},{"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","stores":["microsoft"],"auditor":"QMSCERT"},{"ca":"Buypass","stores":["apple","chrome","microsoft","mozilla"],"auditor":"Attestic B.V."}],"highTransparencyGapCAs":[{"ca":"DigiCert","incidentCount":176,"gapScore":98.3,"mattersCount":3,"auditor":"BDO International","framework":"WebTrust"},{"ca":"Sectigo","incidentCount":112,"gapScore":97.3,"mattersCount":3,"auditor":"BDO International","framework":"WebTrust"},{"ca":"IdenTrust Services, LLC","incidentCount":77,"gapScore":96.1,"mattersCount":4,"auditor":"BDO International","framework":"WebTrust"},{"ca":"SwissSign AG","incidentCount":65,"gapScore":93.8,"mattersCount":4,"auditor":"T\u00dcV Austria","framework":"ETSI"},{"ca":"GlobalSign nv-sa","incidentCount":56,"gapScore":98.2,"mattersCount":1,"auditor":"KPMG","framework":"WebTrust"},{"ca":"Microsoft Corporation","incidentCount":51,"gapScore":94.1,"mattersCount":3,"auditor":"Deloitte","framework":"WebTrust"},{"ca":"Asseco Data Systems S.A.","incidentCount":50,"gapScore":96.0,"mattersCount":2,"auditor":"Ernst & Young","framework":"WebTrust"},{"ca":"GoDaddy","incidentCount":47,"gapScore":93.6,"mattersCount":3,"auditor":"Schellman","framework":"WebTrust"},{"ca":"Netlock","incidentCount":41,"gapScore":82.9,"mattersCount":7,"auditor":"MATRIX Ltd.","framework":"ETSI"},{"ca":"Internet Security Research Group","incidentCount":40,"gapScore":95.0,"mattersCount":2,"auditor":"BDO International","framework":"WebTrust"}],"etsiAalAdoption":{"2":1,"3.1":2,"unknown":3,"3.3":1,"3.0":1,"3.4":15,"3.5":7,"2.9":1},"auditorChanges":[{"year":2024,"ca":"Department of Defence Australia","from":"Deloitte","to":"Ionize"},{"year":2025,"ca":"EDICOM","from":"Audit Trust","to":"AENOR"},{"year":2025,"ca":"Microsoft Corporation","from":"BDO International","to":"Deloitte"},{"year":2025,"ca":"Government of Japan, Digital Agency","from":"Ernst & Young","to":"Deloitte"},{"year":2025,"ca":"IdenTrust Services, LLC","from":"Schellman","to":"BDO International"},{"year":2025,"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","from":"datenschutz cert GmbH","to":"QMSCERT"},{"year":2024,"ca":"Netlock","from":"Certop Informatikai Tan\u00fas\u00edt\u00e1si Szolg\u00e1ltat\u00e1sok Kft.","to":"MATRIX Ltd."},{"year":2024,"ca":"China Financial Certification Authority (CFCA)","from":"PwC","to":"Anthony Kam & Associates Ltd."},{"year":2025,"ca":"TrustAsia Technologies, Inc.","from":"Anthony Kam & Associates Ltd.","to":"SunRise CPAs / DFK"},{"year":2025,"ca":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","from":"Ernst & Young","to":"Moreira Associados Auditores Independentes"},{"year":2025,"ca":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","from":"ICTA/BTK - Turkish Information and Communication Technologies Authority","to":"KIWA CERMET Italia S.p.A"},{"year":2025,"ca":"Agence Nationale de Certification Electronique","from":"LSTI","to":"Deloitte"},{"year":2025,"ca":"Chunghwa Telecom","from":"SunRise CPAs / DFK","to":"KPMG"},{"year":2025,"ca":"Chunghwa Telecom","from":"KPMG","to":"SunRise CPAs / DFK"},{"year":2025,"ca":"Izenpe S.A.","from":"LSTI","to":"AENOR"},{"year":2026,"ca":"Buypass","from":"BSI","to":"Attestic B.V."},{"year":2025,"ca":"Telia Company","from":"KPMG","to":"datenschutz cert GmbH"},{"year":2026,"ca":"A-Trust","from":"Ernst & Young","to":"A-SIT"},{"year":2026,"ca":"GoDaddy","from":"KPMG","to":"Schellman"},{"year":2026,"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","from":"PwC","to":"RSM Hong Kong"},{"year":2026,"ca":"certSIGN","from":"Crowe FST Audit Ltd","to":"LSTI"},{"year":2026,"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","from":"CSQA Certificazioni","to":"DEKRA"},{"year":2026,"ca":"Actalis","from":"IMQ S.p.A.","to":"TayllorCox PCEB"},{"year":2026,"ca":"ComSign","from":"Sharony - Shefler & Co. CPA","to":"BDO Israel"},{"year":2026,"ca":"Halcom D.D.","from":"SLOVENIAN ACCREDITATION","to":"Bureau Veritas d.o.o."}],"mattersWithoutBzAnchor":[{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"Not all necessary information is described in the terms of use."},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The validity period of an identification in which certificates may be issued is "},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The asset management documentation has not been finalized and formally approved "},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The racks are in a server room of the FOITT and shared with other departments; t"},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The Policy and Layout document does not formally list id-etsi-qcs-QcCompliance a"},{"ca":"Carillon Information Security Inc.","summary":"On March 16, 2024, Carillon migrated to a new CIS infrastructure, which included"},{"ca":"IdenTrust Services, LLC","summary":"For two out of two quarters selected for testing, IdenTrust did not select at le"},{"ca":"Saudi Data and Artificial Intelligence Authority (SDAIA)","summary":"During the examination period there were no instances of key generation, key arc"},{"ca":"Google Trust Services LLC","summary":"GTS disclosed an incident involving incomplete onboarding steps for a new team m"},{"ca":"A-Trust","summary":"No assertion to a mass revocation plan in section 5.7.1 of the CP/CPS version 2."},{"ca":"Macao Post and Telecommunications Bureau","summary":"All certificates issued by eSignTrust contain an 'Organisation' attribute of 'Ma"},{"ca":"Government of Sweden (F\u00f6rs\u00e4kringskassan)","summary":"SSIA issued certificates with prohibited organizationalUnitName attribute until "}],"topAuditors":[{"name":"KPMG","caCount":10,"country":"Global (US/UK)","avgQualityScore":70.3,"avgGapScore":99.5,"highGapCount":4,"avgMattersPerCA":0.7},{"name":"Deloitte","caCount":8,"country":"Global (US/UK)","avgQualityScore":76.9,"avgGapScore":77.0,"highGapCount":1,"avgMattersPerCA":1.2},{"name":"BDO International","caCount":6,"country":"Global (US/UK)","avgQualityScore":51.3,"avgGapScore":96.8,"highGapCount":6,"avgMattersPerCA":2.2},{"name":"TayllorCox PCEB","caCount":5,"country":"Czech Republic","avgQualityScore":84.6,"avgGapScore":93.8,"highGapCount":2,"avgMattersPerCA":0.6},{"name":"Ernst & Young","caCount":5,"country":"Global (US/UK)","avgQualityScore":77.6,"avgGapScore":92.8,"highGapCount":3,"avgMattersPerCA":1.6},{"name":"SunRise CPAs / DFK","caCount":5,"country":"United States","avgQualityScore":54.5,"avgGapScore":94.3,"highGapCount":3,"avgMattersPerCA":1.2},{"name":"AENOR","caCount":4,"country":"Spain","avgQualityScore":77.7,"avgGapScore":77.3,"highGapCount":1,"avgMattersPerCA":2.5},{"name":"DEKRA","caCount":3,"country":"Spain","avgQualityScore":70.0,"avgGapScore":100.0,"highGapCount":1,"avgMattersPerCA":0.0},{"name":"Schellman","caCount":3,"country":"United States","avgQualityScore":57.4,"avgGapScore":87.7,"highGapCount":2,"avgMattersPerCA":1.7},{"name":"LSTI","caCount":3,"country":"France","avgQualityScore":87.1,"avgGapScore":80.0,"highGapCount":1,"avgMattersPerCA":3.0},{"name":"A-SIT","caCount":2,"country":"Austria","avgQualityScore":85.7,"avgGapScore":null,"highGapCount":0,"avgMattersPerCA":1.0},{"name":"CSQA Certificazioni","caCount":2,"country":"Italy","avgQualityScore":80.8,"avgGapScore":null,"highGapCount":0,"avgMattersPerCA":0.0}]},"crlInfrastructureHealth":{"generatedAt":"2026-07-18T08:13:59Z","totalUrls":13175,"okCount":13071,"issueCount":104,"casTotal":82,"casWithIssues":23,"healthPct":99.2,"statusBreakdown":{"https_cert_expired":25,"ok":13071,"stale":10,"timeout":3,"http_403":2,"issuer_mismatch":6,"url_inferred":1,"dns_error":1,"br_violation":6,"tls_hostname_mismatch":2,"http_404":3,"connection_error":3,"http_405":41,"parse_failed":1},"totalRevoked":18574320,"revocationsPerDay":85.39,"globalRevocationPpm":18445.718,"revocationReasons":{"unspecified":9524553,"cessationOfOperation":4474320,"superseded":3507133,"privilegeWithdrawn":623053,"keyCompromise":315830,"affiliationChanged":100685,"certificateHold":28710,"cACompromise":31,"removeFromCRL":4,"aACompromise":1},"issuesByStore":{"microsoftOnly":53,"apple":40,"chrome":46,"mozilla":51},"casWithIssuesList":[{"ca":"A-Trust","status":"https_cert_expired","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"AC Camerfirma, S.A.","status":"stale","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Actalis","status":"timeout","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Autoridad de Certificacion Firmaprofesional","status":"http_403","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"ComSign","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Consejo General de la Abogac\u00eda Espa\u00f1ola","status":"url_inferred","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"e-commerce monitoring GmbH","status":"stale","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Entrust","status":"stale","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"GlobalSign nv-sa","status":"br_violation","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"GoDaddy","status":"tls_hostname_mismatch","in_apple":true,"in_chrome":false,"in_mozilla":true,"in_microsoft":true},{"ca":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","status":"http_404","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Government of Japan, Digital Agency","status":"connection_error","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Government of Korea, KLID","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Netlock","status":"br_violation","in_apple":false,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"Notarius","status":"tls_hostname_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Open Access Technology International, Inc. (OATI)","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Prvn\u00ed certifika\u010dn\u00ed autorita, a.s.","status":"https_cert_expired","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Saudi Data and Artificial Intelligence Authority (SDAIA)","status":"http_404","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","status":"http_405","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"SI-TRUST","status":"https_cert_expired","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Thailand National Root Certificate Authority (Electronic Transactions Development Agency)","status":"http_403","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Zetes","status":"parse_failed","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true}],"note":"CRL URLs are filed in CCADB by CA operators. issuer_mismatch means the wrong CRL URL is filed \u2014 CRLite/CRL Sets aggregators may miss revocations from that CA though CDP-fetching browsers are unaffected. br_violation means CRL validity window exceeds BR \u00a74.9.7 limits. Microsoft-only CAs are often government PKIs not governed by CA/B Forum BRs."}}