{"$schema":"https://webpki.systematicreasoning.com/schema.json","version":"1.0.0","generatedAt":"2026-09-16T11:42:51.854764+00:00","snapshotUrl":"https://webpki.systematicreasoning.com/llm_snapshot.json","slices":{"index":"https://webpki.systematicreasoning.com/llm_snapshot_index.json","governance":"https://webpki.systematicreasoning.com/llm_snapshot_governance.json","distrust":"https://webpki.systematicreasoning.com/llm_snapshot_distrust.json","market":"https://webpki.systematicreasoning.com/llm_snapshot_market.json","risk":"https://webpki.systematicreasoning.com/llm_snapshot_risk.json"},"sliceGuide":"This snapshot is ~50k tokens. For targeted analysis fetch a slice: governance (CA/Browser Forum oversight, compliance, BR readiness, audit letter quality), distrust (16 distrust events 2011-2024 + incidents), market (CA market share, trust surface), risk (geographic, government, jurisdiction, full 317-root crypto data). Each slice is self-contained with generatedAt and snapshotUrl.","dataSources":{"crtSh":"Certificate Transparency logs via crt.sh \u2014 unexpired and all-time precertificate counts per CA owner. Updated daily.","ccadb":"Common CA Database (AllCertificateRecordsCSVFormatv4) \u2014 root/intermediate metadata, trust store inclusion, CA owner details. Updated daily.","bugzilla":"Mozilla Bugzilla CA Certificate Compliance \u2014 incident reports, root program comments, CA responses. 2014-present. Updated daily.","statcounter":"StatCounter global browser market share \u2014 mapped to root programs for web coverage estimates. Updated daily.","cabforum":"CA/Browser Forum ballot records \u2014 proposers, endorsers, vote results across Server Certificate, Code Signing, S/MIME, and Network Security working groups.","keylength":"keylength.com \u2014 cryptographic key size recommendations from NIST, ECRYPT-CSA, BSI, ANSSI, and NSA CNSA.","cabforumMembers":"CA/B Forum membership roster \u2014 CA members, browser members, interested parties. Used for ecosystem participation baseline.","chromeRootStore":"Chrome Root Store git commit history \u2014 root additions and removals with timestamps.","tabIntros":"Analyst summaries generated daily by Claude Sonnet from the prior day's data digest. Each intro states the key finding for that tab with specific numbers and connects related tabs.","regulatorySurface":"Normative obligation counts across all CA compliance documents \u2014 CA/Browser Forum BRs (PDF archive 2012-2021 + GitHub tags 2021-present), root program policies, IETF RFCs (operative versions), NIS2 Directive (EUR-Lex), NIST SP 800-53 Rev 5 (OSCAL). Four convention-aware parsers: RFC2119_INLINE, SHALL_LETTERED_LIST, EU_LEGAL, NIST_OSCAL. Ballot timeline from document revision history tables."},"browserCoverage":{"chrome":0.7823,"apple":0.1639,"mozilla":0.0229,"microsoft":0.0},"market":[{"rank":1,"id":"internet-security-research-group","caSlug":"internet-security-research-group","caOwner":"Internet Security Research Group","certs":537978167,"allTimeCerts":9829759571,"share":37.0751,"turnover":18.3,"usageDays":20,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":4,"intermediateCount":13,"webCoverage":96.9,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":0.004,"selfReportPct":51,"incidentCount":41,"matched":true,"inferred":false,"parent":"","note":"All-time volume may be undercounted due to historical cross-signs (now expired) under: IdenTrust Services, LLC.","issuanceCaveat":"historical_cross_sign","crtshUrl":"https://crt.sh/?CAName=Internet%20Security%20Research%20Group"},{"rank":2,"id":"google-trust-services-llc","caSlug":"google-trust-services-llc","caOwner":"Google Trust Services LLC","certs":306298106,"allTimeCerts":2333400132,"share":21.1087,"turnover":7.6,"usageDays":48,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":12,"intermediateCount":12,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":0.017,"selfReportPct":20,"incidentCount":40,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Google%20Trust%20Services%20LLC"},{"rank":3,"id":"digicert","caSlug":"digicert","caOwner":"DigiCert","certs":236129763,"allTimeCerts":1354159445,"share":16.273,"turnover":5.7,"usageDays":64,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":515,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":0.134,"selfReportPct":50,"incidentCount":181,"matched":true,"inferred":false,"parent":"","note":"All-time volume may be undercounted due to historical cross-signs (now expired) under: Sectigo.","issuanceCaveat":"historical_cross_sign","crtshUrl":"https://crt.sh/?CAName=DigiCert"},{"rank":4,"id":"godaddy","caSlug":"godaddy","caOwner":"GoDaddy","certs":141001293,"allTimeCerts":550410753,"share":9.7172,"turnover":3.9,"usageDays":94,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":13,"intermediateCount":21,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":0.087,"selfReportPct":58,"incidentCount":48,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=GoDaddy"},{"rank":5,"id":"sectigo","caSlug":"sectigo","caOwner":"Sectigo","certs":105812896,"allTimeCerts":1475230411,"share":7.2922,"turnover":13.9,"usageDays":26,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United Kingdom","rootCount":38,"intermediateCount":907,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":0.079,"selfReportPct":63,"incidentCount":117,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Sectigo"},{"rank":6,"id":"microsoft-corporation","caSlug":"microsoft-corporation","caOwner":"Microsoft Corporation","certs":56509537,"allTimeCerts":392837506,"share":3.8944,"turnover":7.0,"usageDays":53,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":15,"intermediateCount":14,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":true,"ppm":0.135,"selfReportPct":49,"incidentCount":53,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Microsoft Corporation may be attributed to: DigiCert.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Microsoft%20Corporation"},{"rank":7,"id":"ssl-com","caSlug":"ssl-com","caOwner":"SSL.com","certs":24558565,"allTimeCerts":127403201,"share":1.6925,"turnover":5.2,"usageDays":70,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":23,"intermediateCount":82,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":0.283,"selfReportPct":58,"incidentCount":36,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under SSL.com may be attributed to: Sectigo.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=SSL.com"},{"rank":8,"id":"identrust-services-llc","caSlug":"identrust-services-llc","caOwner":"IdenTrust Services, LLC","certs":18091007,"allTimeCerts":47108834,"share":1.2468,"turnover":2.6,"usageDays":140,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":29,"intermediateCount":28,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":1.677,"selfReportPct":82,"incidentCount":79,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=IdenTrust%20Services%2C%20LLC"},{"rank":9,"id":"amazon-trust-services","caSlug":"amazon-trust-services","caOwner":"Amazon Trust Services","certs":17853684,"allTimeCerts":49302504,"share":1.2304,"turnover":2.8,"usageDays":132,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":8,"intermediateCount":90,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":0.345,"selfReportPct":53,"incidentCount":17,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Amazon Trust Services may be attributed to: GoDaddy.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Amazon%20Trust%20Services"},{"rank":10,"id":"globalsign-nv-sa","caSlug":"globalsign-nv-sa","caOwner":"GlobalSign nv-sa","certs":1613716,"allTimeCerts":54796507,"share":0.1112,"turnover":34.0,"usageDays":11,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Belgium","rootCount":19,"intermediateCount":273,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":1.077,"selfReportPct":63,"incidentCount":59,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=GlobalSign%20nv-sa"},{"rank":11,"id":"actalis","caSlug":"actalis","caOwner":"Actalis","certs":1569860,"allTimeCerts":7381285,"share":0.1082,"turnover":4.7,"usageDays":78,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Italy","rootCount":10,"intermediateCount":19,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":3.658,"selfReportPct":67,"incidentCount":27,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Actalis"},{"rank":12,"id":"trustasia-technologies-inc","caSlug":"trustasia-technologies-inc","caOwner":"TrustAsia Technologies, Inc.","certs":1177286,"allTimeCerts":2328490,"share":0.0811,"turnover":2.0,"usageDays":185,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":false},"storeCount":2,"country":"China","rootCount":12,"intermediateCount":46,"webCoverage":80.5,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":1.288,"selfReportPct":100,"incidentCount":3,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under TrustAsia Technologies, Inc. may be attributed to: Asseco Data Systems S.A..","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=TrustAsia%20Technologies%2C%20Inc."},{"rank":13,"id":"harica","caSlug":"harica","caOwner":"HARICA","certs":1001314,"allTimeCerts":1206530,"share":0.069,"turnover":1.2,"usageDays":303,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Greece","rootCount":9,"intermediateCount":93,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":17.405,"selfReportPct":57,"incidentCount":21,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=HARICA"},{"rank":14,"id":"asseco-data-systems-s-a","caSlug":"asseco-data-systems-s-a","caOwner":"Asseco Data Systems S.A.","certs":698969,"allTimeCerts":6261112,"share":0.0482,"turnover":9.0,"usageDays":41,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Poland","rootCount":14,"intermediateCount":108,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":8.465,"selfReportPct":53,"incidentCount":53,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Asseco%20Data%20Systems%20S.A."},{"rank":17,"id":"emudhra-technologies-limited","caSlug":"emudhra-technologies-limited","caOwner":"eMudhra Technologies Limited","certs":85190,"allTimeCerts":127369,"share":0.0059,"turnover":1.5,"usageDays":244,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"India","rootCount":16,"intermediateCount":80,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":180.578,"selfReportPct":83,"incidentCount":23,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=eMudhra%20Technologies%20Limited"},{"rank":18,"id":"d-trust","caSlug":"d-trust","caOwner":"D-Trust","certs":72138,"allTimeCerts":186839,"share":0.005,"turnover":2.6,"usageDays":141,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":12,"intermediateCount":42,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=D-Trust"},{"rank":19,"id":"certainly-llc","caSlug":"certainly-llc","caOwner":"Certainly LLC","certs":66926,"allTimeCerts":13971815,"share":0.0046,"turnover":208.8,"usageDays":2,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":true},"storeCount":3,"country":"United States","rootCount":2,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":0.859,"selfReportPct":25,"incidentCount":12,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Certainly%20LLC"},{"rank":20,"id":"taiwan-ca-inc-twca","caSlug":"taiwan-ca-inc-twca","caOwner":"Taiwan-CA Inc. (TWCA)","certs":52995,"allTimeCerts":375094,"share":0.0037,"turnover":7.1,"usageDays":52,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Taiwan (Republic of China)","rootCount":5,"intermediateCount":15,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":42.656,"selfReportPct":62,"incidentCount":16,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Taiwan-CA%20Inc.%20%28TWCA%29"},{"rank":21,"id":"swisssign-ag","caSlug":"swisssign-ag","caOwner":"SwissSign AG","certs":42215,"allTimeCerts":193645,"share":0.0029,"turnover":4.6,"usageDays":80,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Switzerland","rootCount":8,"intermediateCount":3,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":351.158,"selfReportPct":78,"incidentCount":68,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=SwissSign%20AG"},{"rank":22,"id":"secom-trust-systems-co-ltd","caSlug":"secom-trust-systems-co-ltd","caOwner":"SECOM Trust Systems Co., Ltd.","certs":39341,"allTimeCerts":507336,"share":0.0027,"turnover":12.9,"usageDays":28,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Japan","rootCount":12,"intermediateCount":38,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=SECOM%20Trust%20Systems%20Co.%2C%20Ltd."},{"rank":23,"id":"cybertrust-japan-co-ltd","caSlug":"cybertrust-japan-co-ltd","caOwner":"Cybertrust Japan Co., Ltd.","certs":37213,"allTimeCerts":221090,"share":0.0026,"turnover":5.9,"usageDays":61,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Japan","rootCount":13,"intermediateCount":6,"webCoverage":2.3,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":13.569,"selfReportPct":33,"incidentCount":3,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Cybertrust%20Japan%20Co.%2C%20Ltd."},{"rank":24,"id":"telia-company","caSlug":"telia-company","caOwner":"Telia Company","certs":35930,"allTimeCerts":145673,"share":0.0025,"turnover":4.1,"usageDays":90,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Sweden","rootCount":12,"intermediateCount":28,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":253.994,"selfReportPct":68,"incidentCount":37,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Telia%20Company"},{"rank":25,"id":"shanghai-electronic-certification-authority-co-ltd","caSlug":"shanghai-electronic-certification-authority-co-ltd","caOwner":"Shanghai Electronic Certification Authority Co., Ltd.","certs":29054,"allTimeCerts":72374,"share":0.002,"turnover":2.5,"usageDays":147,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"China","rootCount":12,"intermediateCount":60,"webCoverage":80.5,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":414.513,"selfReportPct":73,"incidentCount":30,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Shanghai Electronic Certification Authority Co., Ltd. may be attributed to: Asseco Data Systems S.A..","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Shanghai%20Electronic%20Certification%20Authority%20Co.%2C%20Ltd."},{"rank":27,"id":"deutsche-telekom-security-gmbh","caSlug":"deutsche-telekom-security-gmbh","caOwner":"Deutsche Telekom Security GmbH","certs":21277,"allTimeCerts":131290,"share":0.0015,"turnover":6.2,"usageDays":59,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":7,"intermediateCount":37,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":220.885,"selfReportPct":48,"incidentCount":29,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Deutsche%20Telekom%20Security%20GmbH"},{"rank":28,"id":"naver-cloud-trust-services","caSlug":"naver-cloud-trust-services","caOwner":"NAVER Cloud Trust Services","certs":5722,"allTimeCerts":25530,"share":0.0004,"turnover":4.5,"usageDays":82,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Republic of Korea (South Korea)","rootCount":3,"intermediateCount":7,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":391.696,"selfReportPct":70,"incidentCount":10,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=NAVER%20Cloud%20Trust%20Services"},{"rank":29,"id":"china-financial-certification-authority-cfca","caSlug":"china-financial-certification-authority-cfca","caOwner":"China Financial Certification Authority (CFCA)","certs":5348,"allTimeCerts":29085,"share":0.0004,"turnover":5.4,"usageDays":67,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"China","rootCount":9,"intermediateCount":5,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":1237.751,"selfReportPct":53,"incidentCount":36,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=China%20Financial%20Certification%20Authority%20%28CFCA%29"},{"rank":30,"id":"oiste","caSlug":"oiste","caOwner":"OISTE","certs":4820,"allTimeCerts":5510,"share":0.0003,"turnover":1.1,"usageDays":319,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Switzerland","rootCount":7,"intermediateCount":19,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=OISTE"},{"rank":31,"id":"government-of-spain-autoritat-de-certificaci-de-la-comunitat-valenciana-accv","caSlug":"government-of-spain-autoritat-de-certificaci-de-la-comunitat-valenciana-accv","caOwner":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","certs":4742,"allTimeCerts":19902,"share":0.0003,"turnover":4.2,"usageDays":87,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":6,"intermediateCount":3,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":452.216,"selfReportPct":67,"incidentCount":9,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20Autoritat%20de%20Certificaci%C3%B3%20de%20la%20Comunitat%20Valenciana%20%28ACCV%29"},{"rank":32,"id":"certsign","caSlug":"certsign","caOwner":"certSIGN","certs":3862,"allTimeCerts":20189,"share":0.0003,"turnover":5.2,"usageDays":70,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Romania","rootCount":3,"intermediateCount":5,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":1139.234,"selfReportPct":74,"incidentCount":23,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=certSIGN"},{"rank":33,"id":"government-of-spain-f-brica-nacional-de-moneda-y-timbre-fnmt","caSlug":"government-of-spain-f-brica-nacional-de-moneda-y-timbre-fnmt","caOwner":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","certs":3099,"allTimeCerts":17204,"share":0.0002,"turnover":5.6,"usageDays":66,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":7,"intermediateCount":11,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":1162.52,"selfReportPct":80,"incidentCount":20,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20F%C3%A1brica%20Nacional%20de%20Moneda%20y%20Timbre%20%28FNMT%29"},{"rank":34,"id":"government-of-hong-kong-sar-hongkong-post-certizen","caSlug":"government-of-hong-kong-sar-hongkong-post-certizen","caOwner":"Government of Hong Kong (SAR), Hongkong Post, Certizen","certs":2995,"allTimeCerts":17437,"share":0.0002,"turnover":5.8,"usageDays":63,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"China","rootCount":4,"intermediateCount":6,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":458.795,"selfReportPct":88,"incidentCount":8,"matched":true,"inferred":false,"parent":"","note":"Volume may be undercounted. Cross-signed roots mean some certificates issued under Government of Hong Kong (SAR), Hongkong Post, Certizen may be attributed to: GlobalSign nv-sa.","issuanceCaveat":"undercounted_cross_sign","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Hong%20Kong%20%28SAR%29%2C%20Hongkong%20Post%2C%20Certizen"},{"rank":35,"id":"microsec-ltd","caSlug":"microsec-ltd","caOwner":"Microsec Ltd.","certs":2837,"allTimeCerts":12770,"share":0.0002,"turnover":4.5,"usageDays":81,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Hungary","rootCount":13,"intermediateCount":48,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":true,"ppm":1409.554,"selfReportPct":67,"incidentCount":18,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Microsec%20Ltd."},{"rank":36,"id":"open-access-technology-international-inc-oati","caSlug":"open-access-technology-international-inc-oati","caOwner":"Open Access Technology International, Inc. (OATI)","certs":2464,"allTimeCerts":12506,"share":0.0002,"turnover":5.1,"usageDays":72,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"United States","rootCount":3,"intermediateCount":4,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Open%20Access%20Technology%20International%2C%20Inc.%20%28OATI%29"},{"rank":37,"id":"government-of-finland-population-register-centre-s-v-est-rekisterikeskus-vrk","caSlug":"government-of-finland-population-register-centre-s-v-est-rekisterikeskus-vrk","caOwner":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","certs":2400,"allTimeCerts":14249,"share":0.0002,"turnover":5.9,"usageDays":61,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Finland","rootCount":4,"intermediateCount":4,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Finland%2C%20Population%20Register%20Centre%E2%80%99s%20%28V%C3%A4est%C3%B6rekisterikeskus%2C%20VRK%29"},{"rank":38,"id":"wisekey","caSlug":"wisekey","caOwner":"WISeKey","certs":1827,"allTimeCerts":16787,"share":0.0001,"turnover":9.2,"usageDays":40,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Switzerland","rootCount":7,"intermediateCount":19,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":953.118,"selfReportPct":69,"incidentCount":16,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=WISeKey"},{"rank":39,"id":"autoridad-de-certificacion-firmaprofesional","caSlug":"autoridad-de-certificacion-firmaprofesional","caOwner":"Autoridad de Certificacion Firmaprofesional","certs":1341,"allTimeCerts":10643,"share":0.0001,"turnover":7.9,"usageDays":46,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":4,"intermediateCount":7,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":4134.173,"selfReportPct":70,"incidentCount":44,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificacion%20Firmaprofesional"},{"rank":40,"id":"postsignum","caSlug":"postsignum","caOwner":"PostSignum","certs":963,"allTimeCerts":5746,"share":0.0001,"turnover":6.0,"usageDays":61,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Czechia","rootCount":3,"intermediateCount":2,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":348.068,"selfReportPct":100,"incidentCount":2,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=PostSignum"},{"rank":41,"id":"izenpe-s-a","caSlug":"izenpe-s-a","caOwner":"Izenpe S.A.","certs":912,"allTimeCerts":7575,"share":0.0001,"turnover":8.3,"usageDays":44,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Spain","rootCount":5,"intermediateCount":6,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":3036.304,"selfReportPct":57,"incidentCount":23,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Izenpe%20S.A."},{"rank":42,"id":"atos","caSlug":"atos","caOwner":"Atos","certs":904,"allTimeCerts":18988,"share":0.0001,"turnover":21.0,"usageDays":17,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":5,"intermediateCount":25,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Atos"},{"rank":43,"id":"buypass","caSlug":"buypass","caOwner":"Buypass","certs":858,"allTimeCerts":1293950,"share":0.0001,"turnover":1508.1,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Norway","rootCount":5,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":12.365,"selfReportPct":88,"incidentCount":16,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Buypass"},{"rank":44,"id":"global-digital-cybersecurity-authority-co-ltd-formerly-guang-dong-certificate-authority-gdca","caSlug":"global-digital-cybersecurity-authority-co-ltd-formerly-guang-dong-certificate-authority-gdca","caOwner":"Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA))","certs":851,"allTimeCerts":6347,"share":0.0001,"turnover":7.5,"usageDays":49,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"China","rootCount":1,"intermediateCount":3,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":1417.993,"selfReportPct":78,"incidentCount":9,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Global%20Digital%20Cybersecurity%20Authority%20Co.%2C%20Ltd.%20%28Formerly%20Guang%20Dong%20Certificate%20Authority%20%28GDCA%29%29"},{"rank":45,"id":"disig-a-s","caSlug":"disig-a-s","caOwner":"Disig, a.s.","certs":575,"allTimeCerts":1990,"share":0.0,"turnover":3.5,"usageDays":105,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Slovakia","rootCount":5,"intermediateCount":5,"webCoverage":96.9,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":6030.151,"selfReportPct":58,"incidentCount":12,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Disig%2C%20a.s."},{"rank":46,"id":"government-of-brazil-instituto-nacional-de-tecnologia-da-informa-o-iti","caSlug":"government-of-brazil-instituto-nacional-de-tecnologia-da-informa-o-iti","caOwner":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","certs":480,"allTimeCerts":7469,"share":0.0,"turnover":15.6,"usageDays":23,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Brazil","rootCount":6,"intermediateCount":5,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Brazil%2C%20Instituto%20Nacional%20de%20Tecnologia%20da%20Informa%C3%A7%C3%A3o%20%28ITI%29"},{"rank":47,"id":"krajowa-izba-rozliczeniowa-s-a-kir","caSlug":"krajowa-izba-rozliczeniowa-s-a-kir","caOwner":"Krajowa Izba Rozliczeniowa S.A. (KIR)","certs":475,"allTimeCerts":3185,"share":0.0,"turnover":6.7,"usageDays":54,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"Poland","rootCount":5,"intermediateCount":3,"webCoverage":80.5,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":6279.435,"selfReportPct":0,"incidentCount":20,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Krajowa%20Izba%20Rozliczeniowa%20S.A.%20%28KIR%29"},{"rank":48,"id":"prvn-certifika-n-autorita-a-s","caSlug":"prvn-certifika-n-autorita-a-s","caOwner":"Prvn\u00ed certifika\u010dn\u00ed autorita, a.s.","certs":337,"allTimeCerts":2427,"share":0.0,"turnover":7.2,"usageDays":51,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Czechia","rootCount":9,"intermediateCount":12,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Prvn%C3%AD%20certifika%C4%8Dn%C3%AD%20autorita%2C%20a.s."},{"rank":49,"id":"financijska-agencija-fina","caSlug":"financijska-agencija-fina","caOwner":"Financijska agencija (Fina)","certs":313,"allTimeCerts":1997,"share":0.0,"turnover":6.4,"usageDays":57,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Croatia","rootCount":1,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Financijska%20agencija%20%28Fina%29"},{"rank":50,"id":"government-of-india-ministry-of-communications-information-technology-controller-of-certifying-authorities-cca","caSlug":"government-of-india-ministry-of-communications-information-technology-controller-of-certifying-authorities-cca","caOwner":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","certs":187,"allTimeCerts":936,"share":0.0,"turnover":5.0,"usageDays":73,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"India","rootCount":6,"intermediateCount":1,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20India%2C%20Ministry%20of%20Communications%20%26%20Information%20Technology%2C%20Controller%20of%20Certifying%20Authorities%20%28CCA%29"},{"rank":51,"id":"government-of-turkey-kamu-sertifikasyon-merkezi-kamu-sm","caSlug":"government-of-turkey-kamu-sertifikasyon-merkezi-kamu-sm","caOwner":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","certs":144,"allTimeCerts":990,"share":0.0,"turnover":6.9,"usageDays":53,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Turkey","rootCount":3,"intermediateCount":2,"webCoverage":96.9,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":4040.404,"selfReportPct":25,"incidentCount":4,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Turkey%2C%20Kamu%20Sertifikasyon%20Merkezi%20%28Kamu%20SM%29"},{"rank":52,"id":"a-trust","caSlug":"a-trust","caOwner":"A-Trust","certs":133,"allTimeCerts":467,"share":0.0,"turnover":3.5,"usageDays":104,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Austria","rootCount":11,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=A-Trust"},{"rank":54,"id":"visa","caSlug":"visa","caOwner":"Visa","certs":74,"allTimeCerts":436,"share":0.0,"turnover":5.9,"usageDays":62,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"United States","rootCount":5,"intermediateCount":3,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":6880.734,"selfReportPct":0,"incidentCount":3,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Visa"},{"rank":55,"id":"agence-nationale-de-certification-electronique","caSlug":"agence-nationale-de-certification-electronique","caOwner":"Agence Nationale de Certification Electronique","certs":74,"allTimeCerts":852,"share":0.0,"turnover":11.5,"usageDays":32,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":false},"storeCount":3,"country":"Tunisia","rootCount":3,"intermediateCount":2,"webCoverage":80.5,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":5868.545,"selfReportPct":80,"incidentCount":5,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Agence%20Nationale%20de%20Certification%20Electronique"},{"rank":56,"id":"edicom","caSlug":"edicom","caOwner":"EDICOM","certs":52,"allTimeCerts":369,"share":0.0,"turnover":7.1,"usageDays":51,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":2,"intermediateCount":1,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=EDICOM"},{"rank":57,"id":"government-of-korea-klid","caSlug":"government-of-korea-klid","caOwner":"Government of Korea, KLID","certs":37,"allTimeCerts":8659,"share":0.0,"turnover":234.0,"usageDays":2,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Republic of Korea (South Korea)","rootCount":5,"intermediateCount":1,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Korea%2C%20KLID"},{"rank":58,"id":"itruschina-co-ltd","caSlug":"itruschina-co-ltd","caOwner":"iTrusChina Co., Ltd.","certs":17,"allTimeCerts":69,"share":0.0,"turnover":4.1,"usageDays":90,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":false},"storeCount":2,"country":"China","rootCount":2,"intermediateCount":8,"webCoverage":80.5,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=iTrusChina%20Co.%2C%20Ltd."},{"rank":59,"id":"autoridad-de-certificaci-n-anf-ac","caSlug":"autoridad-de-certificaci-n-anf-ac","caOwner":"Autoridad de Certificaci\u00f3n (ANF AC)","certs":12,"allTimeCerts":45,"share":0.0,"turnover":3.8,"usageDays":97,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":true,"apple":false},"storeCount":2,"country":"Spain","rootCount":5,"intermediateCount":1,"webCoverage":80.5,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":288888.889,"selfReportPct":92,"incidentCount":13,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificaci%C3%B3n%20%28ANF%20AC%29"},{"rank":60,"id":"beijing-certificate-authority-co-ltd","caSlug":"beijing-certificate-authority-co-ltd","caOwner":"BEIJING CERTIFICATE AUTHORITY Co., Ltd.","certs":9,"allTimeCerts":123,"share":0.0,"turnover":13.7,"usageDays":27,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":false,"apple":false},"storeCount":1,"country":"China","rootCount":6,"intermediateCount":17,"webCoverage":2.3,"tls":true,"ev":true,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=BEIJING%20CERTIFICATE%20AUTHORITY%20Co.%2C%20Ltd."},{"rank":62,"id":"netlock","caSlug":"netlock","caOwner":"Netlock","certs":3,"allTimeCerts":20105,"share":0.0,"turnover":6701.7,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Hungary","rootCount":13,"intermediateCount":15,"webCoverage":2.3,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":2089.033,"selfReportPct":62,"incidentCount":42,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Netlock"},{"rank":63,"id":"cybertrust-japan-jcsi","caSlug":"cybertrust-japan-jcsi","caOwner":"Cybertrust Japan / JCSI","certs":2,"allTimeCerts":2,"share":0.0,"turnover":1.0,"usageDays":365,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Japan","rootCount":13,"intermediateCount":6,"webCoverage":2.3,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Cybertrust%20Japan%20/%20JCSI"},{"rank":77,"id":"verizon-terremark-nv","caSlug":"verizon-terremark-nv","caOwner":"Verizon Terremark NV","certs":0,"allTimeCerts":6891,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":515,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Verizon%20Terremark%20NV"},{"rank":78,"id":"verizon","caSlug":"verizon","caOwner":"Verizon","certs":0,"allTimeCerts":5,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":515,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Verizon"},{"rank":79,"id":"ac-camerfirma-s-a","caSlug":"ac-camerfirma-s-a","caOwner":"AC Camerfirma, S.A.","certs":0,"allTimeCerts":6766,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":7,"intermediateCount":12,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=AC%20Camerfirma%2C%20S.A."},{"rank":80,"id":"quovadis-trustlink-b-v","caSlug":"quovadis-trustlink-b-v","caOwner":"QuoVadis Trustlink B.V.","certs":0,"allTimeCerts":18282,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":515,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=QuoVadis%20Trustlink%20B.V."},{"rank":81,"id":"t-systems-international-gmbh","caSlug":"t-systems-international-gmbh","caOwner":"T-Systems International GmbH","certs":0,"allTimeCerts":4,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Germany","rootCount":7,"intermediateCount":37,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=T-Systems%20International%20GmbH"},{"rank":88,"id":"consorci-administraci-oberta-de-catalunya-consorci-aoc-catcert","caSlug":"consorci-administraci-oberta-de-catalunya-consorci-aoc-catcert","caOwner":"Consorci Administraci\u00f3 Oberta de Catalunya (Consorci AOC, CATCert)","certs":0,"allTimeCerts":2831,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":1,"intermediateCount":4,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Consorci%20Administraci%C3%B3%20Oberta%20de%20Catalunya%20%28Consorci%20AOC%2C%20CATCert%29"},{"rank":89,"id":"multicert","caSlug":"multicert","caOwner":"MULTICERT","certs":0,"allTimeCerts":4197,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Portugal","rootCount":1,"intermediateCount":4,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=MULTICERT"},{"rank":90,"id":"swiss-bit-swiss-federal-office-of-information-technology-systems-and-telecommunication-foitt","caSlug":"swiss-bit-swiss-federal-office-of-information-technology-systems-and-telecommunication-foitt","caOwner":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Switzerland","rootCount":6,"intermediateCount":0,"webCoverage":0.0,"tls":false,"ev":true,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Swiss%20BIT%2C%20Swiss%20Federal%20Office%20of%20Information%20Technology%2C%20Systems%20and%20Telecommunication%20%28FOITT%29"},{"rank":91,"id":"government-of-the-netherlands-pkioverheid-logius","caSlug":"government-of-the-netherlands-pkioverheid-logius","caOwner":"Government of The Netherlands, PKIoverheid (Logius)","certs":0,"allTimeCerts":4,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"Netherlands","rootCount":5,"intermediateCount":8,"webCoverage":2.3,"tls":false,"ev":true,"smime":true,"codeSigning":false,"ppm":11250000.0,"selfReportPct":71,"incidentCount":45,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20The%20Netherlands%2C%20PKIoverheid%20%28Logius%29"},{"rank":93,"id":"si-trust","caSlug":"si-trust","caOwner":"SI-TRUST","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Slovenia","rootCount":3,"intermediateCount":3,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=SI-TRUST"},{"rank":97,"id":"docaposte-certinomis-sas","caSlug":"docaposte-certinomis-sas","caOwner":"Docaposte Certinomis SAS","certs":0,"allTimeCerts":1375,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"France","rootCount":2,"intermediateCount":7,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Docaposte%20Certinomis%20SAS"},{"rank":98,"id":"quo-vadis-trustlink-b-v","caSlug":"quo-vadis-trustlink-b-v","caOwner":"Quo Vadis Trustlink B.V.","certs":0,"allTimeCerts":15515,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"United States","rootCount":112,"intermediateCount":515,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Quo%20Vadis%20Trustlink%20B.V."},{"rank":106,"id":"government-of-japan-digital-agency","caSlug":"government-of-japan-digital-agency","caOwner":"Government of Japan, Digital Agency","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Japan","rootCount":3,"intermediateCount":2,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Japan%2C%20Digital%20Agency"},{"rank":107,"id":"e-commerce-monitoring-gmbh","caSlug":"e-commerce-monitoring-gmbh","caOwner":"e-commerce monitoring GmbH","certs":0,"allTimeCerts":246,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Austria","rootCount":5,"intermediateCount":34,"webCoverage":0.0,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=e-commerce%20monitoring%20GmbH"},{"rank":121,"id":"halcom-d-d","caSlug":"halcom-d-d","caOwner":"Halcom D.D.","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Slovenia","rootCount":4,"intermediateCount":8,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Halcom%20D.D."},{"rank":123,"id":"consejo-general-de-la-abogac-a-espa-ola","caSlug":"consejo-general-de-la-abogac-a-espa-ola","caOwner":"Consejo General de la Abogac\u00eda Espa\u00f1ola","certs":0,"allTimeCerts":4,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Spain","rootCount":2,"intermediateCount":3,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Consejo%20General%20de%20la%20Abogac%C3%ADa%20Espa%C3%B1ola"},{"rank":128,"id":"comsign","caSlug":"comsign","caOwner":"ComSign","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Israel","rootCount":4,"intermediateCount":6,"webCoverage":0.0,"tls":true,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=ComSign"},{"rank":132,"id":"netrust-pte-ltd","caSlug":"netrust-pte-ltd","caOwner":"Netrust Pte Ltd","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Singapore","rootCount":2,"intermediateCount":2,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Netrust%20Pte%20Ltd"},{"rank":144,"id":"government-of-sweden-f-rs-kringskassan","caSlug":"government-of-sweden-f-rs-kringskassan","caOwner":"Government of Sweden (F\u00f6rs\u00e4kringskassan)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Sweden","rootCount":3,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Sweden%20%28F%C3%B6rs%C3%A4kringskassan%29"},{"rank":148,"id":"department-of-defence-australia","caSlug":"department-of-defence-australia","caOwner":"Department of Defence Australia","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Australia","rootCount":2,"intermediateCount":0,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Department%20of%20Defence%20Australia"},{"rank":153,"id":"carillon-information-security-inc","caSlug":"carillon-information-security-inc","caOwner":"Carillon Information Security Inc.","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Canada","rootCount":2,"intermediateCount":0,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Carillon%20Information%20Security%20Inc."},{"rank":156,"id":"macao-post-and-telecommunications-bureau","caSlug":"macao-post-and-telecommunications-bureau","caOwner":"Macao Post and Telecommunications Bureau","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"China","rootCount":3,"intermediateCount":7,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Macao%20Post%20and%20Telecommunications%20Bureau"},{"rank":163,"id":"trustfactory-pty-ltd","caSlug":"trustfactory-pty-ltd","caOwner":"TrustFactory(Pty)Ltd","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"South Africa","rootCount":2,"intermediateCount":1,"webCoverage":0.0,"tls":false,"ev":false,"smime":false,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=TrustFactory%28Pty%29Ltd"},{"rank":164,"id":"lawtrust","caSlug":"lawtrust","caOwner":"LAWtrust","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":false,"apple":false},"storeCount":2,"country":"South Africa","rootCount":3,"intermediateCount":6,"webCoverage":2.3,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=LAWtrust"},{"rank":167,"id":"zetes","caSlug":"zetes","caOwner":"Zetes","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Belgium","rootCount":1,"intermediateCount":2,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Zetes"},{"rank":169,"id":"saudi-data-and-artificial-intelligence-authority-sdaia","caSlug":"saudi-data-and-artificial-intelligence-authority-sdaia","caOwner":"Saudi Data and Artificial Intelligence Authority (SDAIA)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Saudi Arabia","rootCount":2,"intermediateCount":5,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Saudi%20Data%20and%20Artificial%20Intelligence%20Authority%20%28SDAIA%29"},{"rank":174,"id":"thailand-national-root-certificate-authority-electronic-transactions-development-agency","caSlug":"thailand-national-root-certificate-authority-electronic-transactions-development-agency","caOwner":"Thailand National Root Certificate Authority (Electronic Transactions Development Agency)","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Thailand","rootCount":3,"intermediateCount":5,"webCoverage":0.0,"tls":true,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Thailand%20National%20Root%20Certificate%20Authority%20%28Electronic%20Transactions%20Development%20Agency%29"},{"rank":180,"id":"digitalsign-certificadora-digital-s-a","caSlug":"digitalsign-certificadora-digital-s-a","caOwner":"DigitalSign - Certificadora Digital, S.A.","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":false,"chrome":false,"apple":false},"storeCount":1,"country":"Portugal","rootCount":2,"intermediateCount":8,"webCoverage":2.3,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=DigitalSign%20-%20Certificadora%20Digital%2C%20S.A."},{"rank":190,"id":"notarius","caSlug":"notarius","caOwner":"Notarius","certs":0,"allTimeCerts":0,"share":0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":false,"microsoft":true,"chrome":false,"apple":false},"storeCount":1,"country":"Canada","rootCount":2,"intermediateCount":3,"webCoverage":0.0,"tls":false,"ev":false,"smime":true,"codeSigning":false,"ppm":null,"selfReportPct":null,"incidentCount":0,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Notarius"},{"rank":249,"id":"chunghwa-telecom","caSlug":"chunghwa-telecom","caOwner":"Chunghwa Telecom","certs":-45,"allTimeCerts":41759,"share":-0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"Taiwan, Republic of China","rootCount":6,"intermediateCount":4,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":694.461,"selfReportPct":72,"incidentCount":29,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Chunghwa%20Telecom"},{"rank":250,"id":"certigna","caSlug":"certigna","caOwner":"Certigna","certs":-231,"allTimeCerts":79064,"share":-0.0,"turnover":0,"usageDays":0,"trustedBy":{"mozilla":true,"microsoft":true,"chrome":true,"apple":true},"storeCount":4,"country":"France","rootCount":6,"intermediateCount":10,"webCoverage":96.9,"tls":true,"ev":true,"smime":true,"codeSigning":true,"ppm":379.439,"selfReportPct":47,"incidentCount":30,"matched":true,"inferred":false,"parent":"","note":"","issuanceCaveat":"","crtshUrl":"https://crt.sh/?CAName=Certigna"}],"concentration":{"hhi":2254,"hhiLabel":"moderately concentrated","cr3":74.46,"cr5":91.47,"cr7":97.05,"headCount":21,"headPct":99.9754,"tailCount":68,"tailPct":0.0246},"trustSurface":{"totalRoots":355,"totalOwners":83,"allFourStores":{"roots":74,"owners":37},"perStore":{"Mozilla":{"roots":172,"owners":50},"Microsoft":{"roots":331,"owners":77},"Chrome":{"roots":101,"owners":44},"Apple":{"roots":144,"owners":39}},"rootCombinations":[{"stores":["Microsoft"],"count":158},{"stores":["Apple","Chrome","Microsoft","Mozilla"],"count":74},{"stores":["Apple","Microsoft","Mozilla"],"count":42},{"stores":["Apple","Microsoft"],"count":21},{"stores":["Chrome","Microsoft","Mozilla"],"count":18},{"stores":["Microsoft","Mozilla"],"count":18},{"stores":["Mozilla"],"count":10},{"stores":["Chrome","Mozilla"],"count":7},{"stores":["Apple"],"count":4},{"stores":["Apple","Chrome","Mozilla"],"count":2},{"stores":["Apple","Mozilla"],"count":1}],"ownerCombinations":[{"stores":["Apple","Chrome","Microsoft","Mozilla"],"count":37},{"stores":["Microsoft"],"count":32},{"stores":["Microsoft","Mozilla"],"count":4},{"stores":["Chrome","Microsoft","Mozilla"],"count":3},{"stores":["Chrome","Mozilla"],"count":3},{"stores":["Mozilla"],"count":2},{"stores":["Apple","Chrome","Mozilla"],"count":1},{"stores":["Apple","Microsoft"],"count":1}],"capabilities":{"tls":{"cas":74,"pct":83},"ev":{"cas":46,"pct":52},"smime":{"cas":66,"pct":74},"codeSigning":{"cas":23,"pct":26}}},"chromeRootStoreGrowth":{"source":"chromium/src/net/data/ssl/chrome_root_store commit history","entries":[{"date":"2022-02-16","totalRoots":117,"added":117,"removed":0},{"date":"2022-04-01","totalRoots":115,"added":0,"removed":2},{"date":"2022-04-05","totalRoots":128,"added":19,"removed":6},{"date":"2022-04-08","totalRoots":130,"added":2,"removed":0},{"date":"2022-05-19","totalRoots":132,"added":2,"removed":0},{"date":"2022-08-18","totalRoots":140,"added":10,"removed":2},{"date":"2023-01-14","totalRoots":138,"added":0,"removed":2},{"date":"2023-03-02","totalRoots":135,"added":0,"removed":3},{"date":"2023-06-03","totalRoots":131,"added":0,"removed":4},{"date":"2023-09-20","totalRoots":133,"added":2,"removed":0},{"date":"2023-12-03","totalRoots":134,"added":2,"removed":1},{"date":"2024-03-12","totalRoots":136,"added":2,"removed":0},{"date":"2024-05-30","totalRoots":135,"added":0,"removed":1},{"date":"2024-10-05","totalRoots":134,"added":0,"removed":1},{"date":"2025-03-20","totalRoots":244,"added":110,"removed":0},{"date":"2025-04-24","totalRoots":228,"added":1,"removed":17},{"date":"2025-06-20","totalRoots":239,"added":11,"removed":0},{"date":"2025-06-20","totalRoots":228,"added":0,"removed":11},{"date":"2025-07-09","totalRoots":226,"added":2,"removed":4},{"date":"2025-08-12","totalRoots":237,"added":11,"removed":0},{"date":"2025-10-28","totalRoots":236,"added":0,"removed":1},{"date":"2025-12-16","totalRoots":233,"added":1,"removed":4},{"date":"2026-01-08","totalRoots":239,"added":6,"removed":0},{"date":"2026-02-21","totalRoots":242,"added":4,"removed":1},{"date":"2026-04-14","totalRoots":231,"added":1,"removed":12}]},"geography":[{"region":"United States","caCount":15,"issuancePct":92.26,"certs":1338489586,"countries":[{"country":"United States","caCount":15,"issuancePct":92.26}]},{"region":"Europe","caCount":44,"issuancePct":7.64,"certs":110898549,"countries":[{"country":"United Kingdom","caCount":1,"issuancePct":7.29},{"country":"Belgium","caCount":2,"issuancePct":0.11},{"country":"Italy","caCount":1,"issuancePct":0.11},{"country":"Greece","caCount":1,"issuancePct":0.07},{"country":"Poland","caCount":2,"issuancePct":0.05},{"country":"Germany","caCount":4,"issuancePct":0.01},{"country":"Switzerland","caCount":4,"issuancePct":0.0},{"country":"Sweden","caCount":2,"issuancePct":0.0},{"country":"Spain","caCount":9,"issuancePct":0.0},{"country":"Romania","caCount":1,"issuancePct":0.0},{"country":"Hungary","caCount":2,"issuancePct":0.0},{"country":"Finland","caCount":1,"issuancePct":0.0},{"country":"Czechia","caCount":2,"issuancePct":0.0},{"country":"Norway","caCount":1,"issuancePct":0.0},{"country":"Slovakia","caCount":1,"issuancePct":0.0},{"country":"Croatia","caCount":1,"issuancePct":0.0},{"country":"Austria","caCount":2,"issuancePct":0.0},{"country":"Netherlands","caCount":1,"issuancePct":0.0},{"country":"Portugal","caCount":2,"issuancePct":0.0},{"country":"Slovenia","caCount":2,"issuancePct":0.0},{"country":"France","caCount":2,"issuancePct":-0.0}]},{"region":"Asia-Pacific","caCount":17,"issuancePct":0.09,"certs":1377493,"countries":[{"country":"China","caCount":8,"issuancePct":0.08},{"country":"India","caCount":2,"issuancePct":0.01},{"country":"Japan","caCount":4,"issuancePct":0.01},{"country":"Singapore","caCount":1,"issuancePct":0.0},{"country":"Australia","caCount":1,"issuancePct":0.0},{"country":"Thailand","caCount":1,"issuancePct":0.0}]},{"region":"Americas","caCount":3,"issuancePct":0.0,"certs":480,"countries":[{"country":"Brazil","caCount":1,"issuancePct":0.0},{"country":"Canada","caCount":2,"issuancePct":0.0}]},{"region":"Middle East / Africa","caCount":6,"issuancePct":0.0,"certs":218,"countries":[{"country":"Turkey","caCount":1,"issuancePct":0.0},{"country":"Tunisia","caCount":1,"issuancePct":0.0},{"country":"Israel","caCount":1,"issuancePct":0.0},{"country":"South Africa","caCount":2,"issuancePct":0.0},{"country":"Saudi Arabia","caCount":1,"issuancePct":0.0}]}],"governmentRisk":{"total":30,"issuancePct":0.08,"byType":{"governmentOperated":{"count":21,"certs":15511,"pct":0.0},"stateOwnedEnterprise":{"count":9,"certs":1094629,"pct":0.08}},"cas":[{"caOwner":"HARICA","crtshUrl":"https://crt.sh/?CAName=HARICA","type":"state_owned_enterprise","country":"Greece","relationship":"Operated by Greek academic/research network, government-funded institution","storeCount":4,"certs":1001314},{"caOwner":"Telia Company","crtshUrl":"https://crt.sh/?CAName=Telia%20Company","type":"state_owned_enterprise","country":"Sweden","relationship":"Swedish and Finnish state partial ownership (~37% Swedish state)","storeCount":4,"certs":35930},{"caOwner":"Shanghai Electronic Certification Authority Co., Ltd.","crtshUrl":"https://crt.sh/?CAName=Shanghai%20Electronic%20Certification%20Authority%20Co.%2C%20Ltd.","type":"state_owned_enterprise","country":"China","relationship":"State-affiliated entity, Shanghai municipality","storeCount":3,"certs":29054},{"caOwner":"Deutsche Telekom Security GmbH","crtshUrl":"https://crt.sh/?CAName=Deutsche%20Telekom%20Security%20GmbH","type":"state_owned_enterprise","country":"Germany","relationship":"German federal government holds ~30% of Deutsche Telekom via KfW","storeCount":4,"certs":21277},{"caOwner":"China Financial Certification Authority (CFCA)","crtshUrl":"https://crt.sh/?CAName=China%20Financial%20Certification%20Authority%20%28CFCA%29","type":"state_owned_enterprise","country":"China","relationship":"Established by People's Bank of China","storeCount":4,"certs":5348},{"caOwner":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20Autoritat%20de%20Certificaci%C3%B3%20de%20la%20Comunitat%20Valenciana%20%28ACCV%29","type":"government_operated","country":"Spain","relationship":"Valencian regional government agency","storeCount":4,"certs":4742},{"caOwner":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20F%C3%A1brica%20Nacional%20de%20Moneda%20y%20Timbre%20%28FNMT%29","type":"government_operated","country":"Spain","relationship":"Spanish Royal Mint, government agency","storeCount":4,"certs":3099},{"caOwner":"Government of Hong Kong (SAR), Hongkong Post, Certizen","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Hong%20Kong%20%28SAR%29%2C%20Hongkong%20Post%2C%20Certizen","type":"government_operated","country":"Hong Kong","relationship":"Hong Kong Post, SAR government agency","storeCount":4,"certs":2995},{"caOwner":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Finland%2C%20Population%20Register%20Centre%E2%80%99s%20%28V%C3%A4est%C3%B6rekisterikeskus%2C%20VRK%29","type":"government_operated","country":"Finland","relationship":"Finnish population register, government agency","storeCount":1,"certs":2400},{"caOwner":"Autoridad de Certificacion Firmaprofesional","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificacion%20Firmaprofesional","type":"government_operated","country":"Spain","relationship":"Spanish notarial professional body, quasi-governmental","storeCount":4,"certs":1341},{"caOwner":"PostSignum","crtshUrl":"https://crt.sh/?CAName=PostSignum","type":"state_owned_enterprise","country":"Czechia","relationship":"Operated by \u010cesk\u00e1 po\u0161ta, s.p. (Czech Post), a state-owned enterprise of the Czech Republic","storeCount":1,"certs":963},{"caOwner":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Brazil%2C%20Instituto%20Nacional%20de%20Tecnologia%20da%20Informa%C3%A7%C3%A3o%20%28ITI%29","type":"government_operated","country":"Brazil","relationship":"Brazilian federal IT institute, operates ICP-Brasil","storeCount":1,"certs":480},{"caOwner":"Krajowa Izba Rozliczeniowa S.A. (KIR)","crtshUrl":"https://crt.sh/?CAName=Krajowa%20Izba%20Rozliczeniowa%20S.A.%20%28KIR%29","type":"state_owned_enterprise","country":"Poland","relationship":"Polish interbank clearing house, established by statute, owned by National Bank of Poland and commercial banks under state mandate","storeCount":3,"certs":475},{"caOwner":"Financijska agencija (Fina)","crtshUrl":"https://crt.sh/?CAName=Financijska%20agencija%20%28Fina%29","type":"state_owned_enterprise","country":"Croatia","relationship":"Croatian state-owned financial agency","storeCount":1,"certs":313},{"caOwner":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20India%2C%20Ministry%20of%20Communications%20%26%20Information%20Technology%2C%20Controller%20of%20Certifying%20Authorities%20%28CCA%29","type":"government_operated","country":"India","relationship":"Indian federal ministry","storeCount":1,"certs":187},{"caOwner":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Turkey%2C%20Kamu%20Sertifikasyon%20Merkezi%20%28Kamu%20SM%29","type":"government_operated","country":"Turkey","relationship":"Turkish government certification center","storeCount":4,"certs":144},{"caOwner":"Agence Nationale de Certification Electronique","crtshUrl":"https://crt.sh/?CAName=Agence%20Nationale%20de%20Certification%20Electronique","type":"government_operated","country":"Tunisia","relationship":"Tunisian national certification agency","storeCount":3,"certs":74},{"caOwner":"Government of Korea, KLID","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Korea%2C%20KLID","type":"government_operated","country":"South Korea","relationship":"Korean government agency","storeCount":1,"certs":37},{"caOwner":"Autoridad de Certificaci\u00f3n (ANF AC)","crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificaci%C3%B3n%20%28ANF%20AC%29","type":"government_operated","country":"Spain","relationship":"Spanish certification authority","storeCount":2,"certs":12},{"caOwner":"Consorci Administraci\u00f3 Oberta de Catalunya (Consorci AOC, CATCert)","crtshUrl":"https://crt.sh/?CAName=Consorci%20Administraci%C3%B3%20Oberta%20de%20Catalunya%20%28Consorci%20AOC%2C%20CATCert%29","type":"government_operated","country":"Spain","relationship":"Public-sector consortium of Catalan regional and local governments, established by act of the Catalan Parliament (Law 29/2010)","storeCount":1,"certs":0},{"caOwner":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","crtshUrl":"https://crt.sh/?CAName=Swiss%20BIT%2C%20Swiss%20Federal%20Office%20of%20Information%20Technology%2C%20Systems%20and%20Telecommunication%20%28FOITT%29","type":"government_operated","country":"Switzerland","relationship":"Swiss Federal Office of Information Technology, Systems and Telecommunication","storeCount":1,"certs":0},{"caOwner":"Government of The Netherlands, PKIoverheid (Logius)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20The%20Netherlands%2C%20PKIoverheid%20%28Logius%29","type":"government_operated","country":"Netherlands","relationship":"Dutch government PKI operated by Logius","storeCount":2,"certs":0},{"caOwner":"SI-TRUST","crtshUrl":"https://crt.sh/?CAName=SI-TRUST","type":"government_operated","country":"Slovenia","relationship":"Slovenian government trust service provider","storeCount":1,"certs":0},{"caOwner":"Government of Japan, Digital Agency","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Japan%2C%20Digital%20Agency","type":"government_operated","country":"Japan","relationship":"Japanese Digital Agency, cabinet-level","storeCount":1,"certs":0},{"caOwner":"Consejo General de la Abogac\u00eda Espa\u00f1ola","crtshUrl":"https://crt.sh/?CAName=Consejo%20General%20de%20la%20Abogac%C3%ADa%20Espa%C3%B1ola","type":"government_operated","country":"Spain","relationship":"Spanish General Council of Bar Associations \u2014 statutory professional body established by Spanish law","storeCount":1,"certs":0},{"caOwner":"Government of Sweden (F\u00f6rs\u00e4kringskassan)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20Sweden%20%28F%C3%B6rs%C3%A4kringskassan%29","type":"government_operated","country":"Sweden","relationship":"Swedish Social Insurance Agency","storeCount":1,"certs":0},{"caOwner":"Department of Defence Australia","crtshUrl":"https://crt.sh/?CAName=Department%20of%20Defence%20Australia","type":"government_operated","country":"Australia","relationship":"Australian Department of Defence, federal government","storeCount":1,"certs":0},{"caOwner":"Macao Post and Telecommunications Bureau","crtshUrl":"https://crt.sh/?CAName=Macao%20Post%20and%20Telecommunications%20Bureau","type":"government_operated","country":"Macao","relationship":"Macao SAR government postal and telecom bureau","storeCount":1,"certs":0},{"caOwner":"Thailand National Root Certificate Authority (Electronic Transactions Development Agency)","crtshUrl":"https://crt.sh/?CAName=Thailand%20National%20Root%20Certificate%20Authority%20%28Electronic%20Transactions%20Development%20Agency%29","type":"government_operated","country":"Thailand","relationship":"Thai Electronic Transactions Development Agency","storeCount":1,"certs":0},{"caOwner":"Chunghwa Telecom","crtshUrl":"https://crt.sh/?CAName=Chunghwa%20Telecom","type":"state_owned_enterprise","country":"Taiwan","relationship":"Majority state-owned telecom (Taiwan Ministry of Transportation)","storeCount":4,"certs":-45}]},"jurisdictionRisk":[{"country":"China","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"Mandatory cooperation for all organizations (NIL Art. 7/14); full SCA access to systems and keys in critical information infrastructure (Cryptography Law Art. 31).","laws":[{"name":"National Intelligence Law (2017)","section":"Articles 7, 14","excerpt":"All organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law."},{"name":"Cryptography Law (2019)","section":"Article 31","excerpt":"SCA and local agencies have complete access to the cryptography system and to the data protected by that system."},{"name":"Cybersecurity Law (2016)","section":"Article 28","excerpt":"Network operators shall provide technical support and assistance to public security organs and national security organs."}],"caCount":8,"exposedCerts":1215560},{"country":"Russia","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"FSB direct access via SORM; Yarovaya Law requires encryption key disclosure without court order.","laws":[{"name":"Yarovaya Law (2016)","section":"Federal Law 374-FZ","excerpt":"Any online service that uses encrypted data is required to permit the FSB to access encrypted communications, including providing any encryption keys."},{"name":"SORM Regulations (1995+)","section":"System for Operative Investigative Activities","excerpt":"FSB has access to electronic messages and the keys to decrypt these without judicial authorization."}],"caCount":0,"exposedCerts":0},{"country":"United Kingdom","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"RIPA s.49 compels key disclosure with up to 5yr penalty; IPA 2016 Technical Capability Notices; tipping-off ban prevents disclosure to auditors.","laws":[{"name":"RIPA 2000, Part III","section":"Sections 49, 53, 54","excerpt":"A disclosure requirement is necessary if it is necessary (a) in the interests of national security; (b) for preventing or detecting crime; (c) in the interests of the economic well-being of the UK."},{"name":"Investigatory Powers Act 2016","section":"Technical Capability Notices","excerpt":"Government can serve Technical Capability Notices requiring operators to remove electronic protection on communications on an ongoing basis."}],"caCount":1,"exposedCerts":105812896},{"country":"Australia","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"purpose"},"summary":"TOLA Act TANs/TCNs compel decryption assistance from broad DCP class; 5yr gag order penalty; 10yr for warrant non-compliance.","laws":[{"name":"Assistance and Access Act 2018 (TOLA)","section":"TAR / TAN / TCN framework","excerpt":"DCPs include software developers, device manufacturers, and anyone who provides services that facilitate a carriage or electronic service."}],"caCount":1,"exposedCerts":0},{"country":"India","risk":"moderate","axes":{"keySeizure":"purpose","compelledIssuance":"purpose","secrecy":"none"},"summary":"IT Act s.69 executive orders to intermediaries; no judicial oversight; 7yr penalty for noncompliance.","laws":[{"name":"Information Technology Act 2000 (amended 2008)","section":"Section 69(1)(3)(4)","excerpt":"The subscriber or intermediary or any person in-charge of the computer resource shall assist the agency to intercept, monitor, or decrypt the information. Failure: imprisonment up to seven years."}],"caCount":2,"exposedCerts":85377},{"country":"United States","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Judicial oversight required; CALEA limits carrier decryption duty; All Writs Act and NSLs (with gag) possible. Lavabit precedent for SSL keys.","laws":[{"name":"CALEA (1994)","section":"Section 103(a)","excerpt":"A carrier shall not be responsible for decrypting any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier."},{"name":"NSLs / All Writs Act","section":"18 USC \u00a72709; 28 USC \u00a71651","excerpt":"Lavabit shut down rather than surrender its master private keys due to the government wanting to spy on Edward Snowden's emails."}],"caCount":15,"exposedCerts":1338489586},{"country":"France","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Judicial orders only; 3yr / \u20ac270K penalty for refusal.","laws":[{"name":"Code of Criminal Procedure","section":"Article 230-1","excerpt":"A judge may designate a technical expert to obtain plaintext from encrypted data seized during an investigation."}],"caCount":2,"exposedCerts":-231},{"country":"New Zealand","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"general","secrecy":"none"},"summary":"TICSA requires interception capability; Search and Surveillance Act s.130 compels key access under warrant.","laws":[{"name":"TICSA (2013)","section":"Interception capability","excerpt":"Network operators must decrypt communications if they have provided the encryption or hold the decryption key."}],"caCount":0,"exposedCerts":0},{"country":"South Africa","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"RICA s.21 requires provider decryption assistance if key held. Key safeguards struck down by Constitutional Court in 2021; amendments pending.","laws":[{"name":"RICA 2002","section":"Section 21","excerpt":"Encrypted communications must be provided in decrypted form if the provider holds the decryption key."}],"caCount":2,"exposedCerts":0},{"country":"Turkey","risk":"moderate","axes":{"keySeizure":"purpose","compelledIssuance":"none","secrecy":"none"},"summary":"BTK orders for hosting/access providers; electronic communications law requires interception capability.","laws":[{"name":"Law No. 5651 (2007, amended)","section":"BTK authority","excerpt":"Hosting and access providers must comply with government orders including providing access to encrypted data."}],"caCount":1,"exposedCerts":144},{"country":"Cambodia","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"E-Commerce Law Art. 43 prohibits encrypting evidence; untested but broadly worded.","laws":[{"name":"Law on Electronic Commerce (2019)","section":"Article 43","excerpt":"Prohibits any encryption of evidence in the form of data that could lead to an indictment, or any evidence in an electronic system that relates to an offense."}],"caCount":0,"exposedCerts":0},{"country":"Belgium","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Third-party (non-suspect) assistance only; judicial order required. GlobalSign incorporated here.","laws":[{"name":"Code of Criminal Procedure","section":"Article 88quater","excerpt":"A judge may order non-suspect third parties to provide decryption assistance. Suspects protected by self-incrimination principle."}],"caCount":2,"exposedCerts":1613716},{"country":"Finland","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"System admins compelled; suspects exempt under Coercive Measures Act.","laws":[{"name":"Coercive Measures Act (2011)","section":"Chapter 8","excerpt":"System owners and administrators must surrender necessary passwords. Suspects themselves are exempt."}],"caCount":1,"exposedCerts":2400},{"country":"Germany","risk":"low","axes":{"keySeizure":"none","compelledIssuance":"none","secrecy":"none"},"summary":"Strong nemo tenetur; no compulsion for suspects; regulatory readability obligations only in non-criminal contexts.","laws":[{"name":"Strafprozessordnung (StPO)","section":"Criminal Procedure Code","excerpt":"Suspects cannot be compelled to hand over any kind of cryptographic key due to the nemo tenetur principle."}],"caCount":4,"exposedCerts":94319},{"country":"Canada","risk":"low","axes":{"keySeizure":"none","compelledIssuance":"none","secrecy":"none"},"summary":"Charter s.11(c) protects against compelled self-incrimination. No statutory key-disclosure law. Strongest Five Eyes protections.","laws":[{"name":"Charter of Rights and Freedoms (1982)","section":"Section 11(c)","excerpt":"No legislative power can require individuals to decrypt encrypted communications. The federal government has recognised it has no legislative authority to compel individuals to provide a password."}],"caCount":2,"exposedCerts":0},{"country":"Hong Kong","risk":"high","axes":{"keySeizure":"purpose","compelledIssuance":"general","secrecy":"purpose"},"summary":"NSL Art.43 allows police to search/seize electronic devices and compel assistance without judicial oversight for national security matters; Schedule 6 para 3 imposes statutory non-disclosure obligation on assisting parties. Pre-NSL, ICSO Cap.589 required panel judge authorization; post-2020 NSL creates a parallel track with executive authorization and no independent oversight.","laws":[{"name":"National Security Law (2020)","section":"Article 43; Schedule 6 paragraphs 3, 7","excerpt":""},{"name":"Interception of Communications and Surveillance Ordinance (Cap. 589)","section":"ICSO \u2014 superseded by NSL for national security matters","excerpt":""}],"caCount":0,"exposedCerts":0},{"country":"Netherlands","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Art.126m(6) DCCP compels third parties with knowledge of an encryption method to assist decryption when a serious offence is suspected; cannot target the suspect (Art.126m(7)). Judicial oversight via public prosecutor order. No compelled issuance mechanism or statutory gag.","laws":[{"name":"Code of Criminal Procedure (Wetboek van Strafvordering)","section":"Article 126m(6), 126m(7)","excerpt":""}],"caCount":1,"exposedCerts":0},{"country":"Spain","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"LECrim Art.588ter (Organic Law 13/2015) requires judicial order for interception of telecommunications. LGTel Art.39.11 requires operators to deliver communications free of encryption effects where reversible. Judicial oversight required throughout; no statutory compelled issuance or gag.","laws":[{"name":"Ley de Enjuiciamiento Criminal (LECrim)","section":"Article 588ter a; Article 588 bis a","excerpt":""},{"name":"General Telecommunications Act (LGTel, Law 11/2022)","section":"Article 39.11","excerpt":""}],"caCount":9,"exposedCerts":10158},{"country":"Brazil","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Law 9.296/1996 Art.1 requires judicial order for interception; providers must make available technological resources to suspend confidentiality including decryption where provider has capability. Brazilian courts have applied this aggressively \u2014 executives arrested and services suspended to compel compliance (WhatsApp, 2015\u20132016). No compelled issuance statute; no gag provision.","laws":[{"name":"Lei 9.296/1996 (Communications Interception Law)","section":"Article 1","excerpt":""},{"name":"Marco Civil da Internet (Law 12.965/2014)","section":"Article 7(II), Article 10","excerpt":""}],"caCount":1,"exposedCerts":480},{"country":"Greece","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"Presidential Decree 47 compels service providers to decrypt communications and stored data on competent authority request. Law 2225/1994 as amended governs lawful interception; judicial order required. No purpose-built key seizure statute targeting CA signing keys; no compelled issuance mechanism; no statutory gag.","laws":[{"name":"Presidential Decree 47","section":"Provider decryption obligation","excerpt":""},{"name":"Law 2225/1994 (as amended)","section":"Lawful interception framework","excerpt":""}],"caCount":1,"exposedCerts":1001314},{"country":"Switzerland","risk":"low","axes":{"keySeizure":"general","compelledIssuance":"none","secrecy":"none"},"summary":"B\u00dcPF (SR 780.1) Art.22 requires providers to hand over available data under judicial order. No general key-disclosure mandate in current law; proposed V\u00dcPF Art.50a decryption requirement is not yet enacted (consultation closed May 2025, outcome pending). No compelled issuance mechanism; no gag provision.","laws":[{"name":"Federal Act on the Surveillance of Post and Telecommunications (B\u00dcPF, SR 780.1)","section":"Article 22","excerpt":""}],"caCount":4,"exposedCerts":48862}],"incidents":{"total":1572,"caCount":54,"years":[{"year":2014,"count":2},{"year":2015,"count":1},{"year":2016,"count":5},{"year":2017,"count":80},{"year":2018,"count":78},{"year":2019,"count":196},{"year":2020,"count":203},{"year":2021,"count":161},{"year":2022,"count":96},{"year":2023,"count":126},{"year":2024,"count":200},{"year":2025,"count":214},{"year":2026,"count":210}],"perCA":[{"ca":"DigiCert","id":"digicert","count":181,"selfReported":90,"externallyReported":91,"selfReportPct":50,"ppm":0.134,"trusted":true},{"ca":"Sectigo","id":"sectigo","count":117,"selfReported":74,"externallyReported":43,"selfReportPct":63,"ppm":0.079,"trusted":true},{"ca":"IdenTrust Services, LLC","id":"identrust-services-llc","count":79,"selfReported":65,"externallyReported":14,"selfReportPct":82,"ppm":1.677,"trusted":true},{"ca":"SwissSign AG","id":"swisssign-ag","count":68,"selfReported":53,"externallyReported":15,"selfReportPct":78,"ppm":351.158,"trusted":true},{"ca":"GlobalSign nv-sa","id":"globalsign-nv-sa","count":59,"selfReported":37,"externallyReported":22,"selfReportPct":63,"ppm":1.077,"trusted":true},{"ca":"Asseco Data Systems S.A.","id":"asseco-data-systems-s-a","count":53,"selfReported":28,"externallyReported":25,"selfReportPct":53,"ppm":8.465,"trusted":true},{"ca":"Microsoft Corporation","id":"microsoft-corporation","count":53,"selfReported":26,"externallyReported":27,"selfReportPct":49,"ppm":0.135,"trusted":true},{"ca":"GoDaddy","id":"godaddy","count":48,"selfReported":28,"externallyReported":20,"selfReportPct":58,"ppm":0.087,"trusted":true},{"ca":"Government of The Netherlands, PKIoverheid (Logius)","id":"government-of-the-netherlands-pkioverheid-logius","count":45,"selfReported":32,"externallyReported":13,"selfReportPct":71,"ppm":11250000.0,"trusted":true},{"ca":"Autoridad de Certificacion Firmaprofesional","id":"autoridad-de-certificacion-firmaprofesional","count":44,"selfReported":31,"externallyReported":13,"selfReportPct":70,"ppm":4134.173,"trusted":true},{"ca":"Netlock","id":"netlock","count":42,"selfReported":26,"externallyReported":16,"selfReportPct":62,"ppm":2089.033,"trusted":true},{"ca":"Internet Security Research Group","id":"internet-security-research-group","count":41,"selfReported":21,"externallyReported":20,"selfReportPct":51,"ppm":0.004,"trusted":true},{"ca":"Google Trust Services LLC","id":"google-trust-services-llc","count":40,"selfReported":8,"externallyReported":32,"selfReportPct":20,"ppm":0.017,"trusted":true},{"ca":"SECOM Trust Systems CO., LTD.","id":"secom-trust-systems-co-ltd","count":39,"selfReported":22,"externallyReported":17,"selfReportPct":56,"ppm":76.872,"trusted":true},{"ca":"Telia Company","id":"telia-company","count":37,"selfReported":25,"externallyReported":12,"selfReportPct":68,"ppm":253.994,"trusted":true},{"ca":"China Financial Certification Authority (CFCA)","id":"china-financial-certification-authority-cfca","count":36,"selfReported":19,"externallyReported":17,"selfReportPct":53,"ppm":1237.751,"trusted":true},{"ca":"SSL.com","id":"ssl-com","count":36,"selfReported":21,"externallyReported":15,"selfReportPct":58,"ppm":0.283,"trusted":true},{"ca":"D-TRUST","id":"d-trust","count":34,"selfReported":23,"externallyReported":11,"selfReportPct":68,"ppm":181.975,"trusted":true},{"ca":"Certigna","id":"certigna","count":30,"selfReported":14,"externallyReported":16,"selfReportPct":47,"ppm":379.439,"trusted":true},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","id":"shanghai-electronic-certification-authority-co-ltd","count":30,"selfReported":22,"externallyReported":8,"selfReportPct":73,"ppm":414.513,"trusted":true},{"ca":"Deutsche Telekom Security GmbH","id":"deutsche-telekom-security-gmbh","count":29,"selfReported":14,"externallyReported":15,"selfReportPct":48,"ppm":220.885,"trusted":true},{"ca":"Chunghwa Telecom","id":"chunghwa-telecom","count":29,"selfReported":21,"externallyReported":8,"selfReportPct":72,"ppm":694.461,"trusted":true},{"ca":"Actalis","id":"actalis","count":27,"selfReported":18,"externallyReported":9,"selfReportPct":67,"ppm":3.658,"trusted":true},{"ca":"Izenpe S.A.","id":"izenpe-s-a","count":23,"selfReported":13,"externallyReported":10,"selfReportPct":57,"ppm":3036.304,"trusted":true},{"ca":"certSIGN","id":"certsign","count":23,"selfReported":17,"externallyReported":6,"selfReportPct":74,"ppm":1139.234,"trusted":true},{"ca":"eMudhra Technologies Limited","id":"emudhra-technologies-limited","count":23,"selfReported":19,"externallyReported":4,"selfReportPct":83,"ppm":180.578,"trusted":true},{"ca":"HARICA","id":"harica","count":21,"selfReported":12,"externallyReported":9,"selfReportPct":57,"ppm":17.405,"trusted":true},{"ca":"Krajowa Izba Rozliczeniowa S.A. (KIR)","id":"krajowa-izba-rozliczeniowa-s-a-kir","count":20,"selfReported":0,"externallyReported":20,"selfReportPct":0,"ppm":6279.435,"trusted":true},{"ca":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","id":"government-of-spain-f-brica-nacional-de-moneda-y-timbre-fnmt","count":20,"selfReported":16,"externallyReported":4,"selfReportPct":80,"ppm":1162.52,"trusted":true},{"ca":"Viking Cloud, Inc.","id":"viking-cloud-inc","count":20,"selfReported":8,"externallyReported":12,"selfReportPct":40,"ppm":null,"trusted":false},{"ca":"Microsec Ltd.","id":"microsec-ltd","count":18,"selfReported":12,"externallyReported":6,"selfReportPct":67,"ppm":1409.554,"trusted":true},{"ca":"Amazon Trust Services","id":"amazon-trust-services","count":17,"selfReported":9,"externallyReported":8,"selfReportPct":53,"ppm":0.345,"trusted":true},{"ca":"Taiwan-CA Inc. (TWCA)","id":"taiwan-ca-inc-twca","count":16,"selfReported":10,"externallyReported":6,"selfReportPct":62,"ppm":42.656,"trusted":true},{"ca":"WISeKey","id":"wisekey","count":16,"selfReported":11,"externallyReported":5,"selfReportPct":69,"ppm":953.118,"trusted":true},{"ca":"Buypass","id":"buypass","count":16,"selfReported":14,"externallyReported":2,"selfReportPct":88,"ppm":12.365,"trusted":true},{"ca":"Apple Inc.","id":"apple-inc","count":15,"selfReported":15,"externallyReported":0,"selfReportPct":100,"ppm":null,"trusted":false},{"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","id":"autoridad-de-certificaci-n-anf-ac","count":13,"selfReported":12,"externallyReported":1,"selfReportPct":92,"ppm":288888.889,"trusted":true},{"ca":"Disig, a.s.","id":"disig-a-s","count":12,"selfReported":7,"externallyReported":5,"selfReportPct":58,"ppm":6030.151,"trusted":true},{"ca":"Certainly LLC","id":"certainly-llc","count":12,"selfReported":3,"externallyReported":9,"selfReportPct":25,"ppm":0.859,"trusted":true},{"ca":"iTrusChina","id":"itruschina","count":10,"selfReported":8,"externallyReported":2,"selfReportPct":80,"ppm":null,"trusted":false},{"ca":"NAVER Cloud Trust Services","id":"naver-cloud-trust-services","count":10,"selfReported":7,"externallyReported":3,"selfReportPct":70,"ppm":391.696,"trusted":true},{"ca":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","id":"government-of-spain-autoritat-de-certificaci-de-la-comunitat-valenciana-accv","count":9,"selfReported":6,"externallyReported":3,"selfReportPct":67,"ppm":452.216,"trusted":true},{"ca":"Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA))","id":"global-digital-cybersecurity-authority-co-ltd-formerly-guang-dong-certificate-authority-gdca","count":9,"selfReported":7,"externallyReported":2,"selfReportPct":78,"ppm":1417.993,"trusted":true},{"ca":"Consorci AOC","id":"consorci-aoc","count":8,"selfReported":2,"externallyReported":6,"selfReportPct":25,"ppm":null,"trusted":false},{"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","id":"government-of-hong-kong-sar-hongkong-post-certizen","count":8,"selfReported":7,"externallyReported":1,"selfReportPct":88,"ppm":458.795,"trusted":true},{"ca":"CommScope","id":"commscope","count":8,"selfReported":5,"externallyReported":3,"selfReportPct":62,"ppm":null,"trusted":false},{"ca":"Eviden","id":"eviden","count":6,"selfReported":3,"externallyReported":3,"selfReportPct":50,"ppm":null,"trusted":false},{"ca":"Agence Nationale de Certification Electronique","id":"agence-nationale-de-certification-electronique","count":5,"selfReported":4,"externallyReported":1,"selfReportPct":80,"ppm":5868.545,"trusted":true},{"ca":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","id":"government-of-turkey-kamu-sertifikasyon-merkezi-kamu-sm","count":4,"selfReported":1,"externallyReported":3,"selfReportPct":25,"ppm":4040.404,"trusted":true},{"ca":"Visa","id":"visa","count":3,"selfReported":0,"externallyReported":3,"selfReportPct":0,"ppm":6880.734,"trusted":true},{"ca":"Cybertrust Japan Co., Ltd.","id":"cybertrust-japan-co-ltd","count":3,"selfReported":1,"externallyReported":2,"selfReportPct":33,"ppm":13.569,"trusted":true},{"ca":"TrustAsia Technologies, Inc.","id":"trustasia-technologies-inc","count":3,"selfReported":3,"externallyReported":0,"selfReportPct":100,"ppm":1.288,"trusted":true},{"ca":"SK ID Solutions AS","id":"sk-id-solutions-as","count":2,"selfReported":0,"externallyReported":2,"selfReportPct":0,"ppm":null,"trusted":false},{"ca":"PostSignum","id":"postsignum","count":2,"selfReported":2,"externallyReported":0,"selfReportPct":100,"ppm":348.068,"trusted":true}],"classification":{"misissuance":611,"revocation":332,"governance":505,"validation":124},"yearsByClass":[{"year":2014,"misissuance":2,"revocation":0,"governance":0,"validation":0},{"year":2015,"misissuance":1,"revocation":0,"governance":0,"validation":0},{"year":2016,"misissuance":3,"revocation":0,"governance":0,"validation":2},{"year":2017,"misissuance":45,"revocation":14,"governance":9,"validation":12},{"year":2018,"misissuance":40,"revocation":5,"governance":26,"validation":7},{"year":2019,"misissuance":111,"revocation":29,"governance":47,"validation":9},{"year":2020,"misissuance":82,"revocation":62,"governance":47,"validation":12},{"year":2021,"misissuance":73,"revocation":33,"governance":37,"validation":18},{"year":2022,"misissuance":35,"revocation":36,"governance":15,"validation":10},{"year":2023,"misissuance":48,"revocation":38,"governance":27,"validation":13},{"year":2024,"misissuance":76,"revocation":48,"governance":56,"validation":20},{"year":2025,"misissuance":42,"revocation":32,"governance":129,"validation":11},{"year":2026,"misissuance":53,"revocation":35,"governance":112,"validation":10}],"fingerprints":[{"ca":"DigiCert","misissuance":86,"revocation":34,"governance":43,"validation":18},{"ca":"Sectigo","misissuance":49,"revocation":20,"governance":24,"validation":24},{"ca":"IdenTrust Services, LLC","misissuance":30,"revocation":25,"governance":22,"validation":2},{"ca":"SwissSign AG","misissuance":33,"revocation":10,"governance":24,"validation":1},{"ca":"GlobalSign nv-sa","misissuance":35,"revocation":14,"governance":5,"validation":5},{"ca":"Asseco Data Systems S.A.","misissuance":25,"revocation":10,"governance":14,"validation":4},{"ca":"Microsoft Corporation","misissuance":13,"revocation":9,"governance":31,"validation":0},{"ca":"GoDaddy","misissuance":13,"revocation":16,"governance":11,"validation":8},{"ca":"Government of The Netherlands, PKIoverheid (Logius)","misissuance":7,"revocation":3,"governance":35,"validation":0},{"ca":"Autoridad de Certificacion Firmaprofesional","misissuance":8,"revocation":4,"governance":32,"validation":0},{"ca":"Netlock","misissuance":10,"revocation":11,"governance":20,"validation":1},{"ca":"Internet Security Research Group","misissuance":10,"revocation":18,"governance":5,"validation":8},{"ca":"Google Trust Services LLC","misissuance":6,"revocation":14,"governance":14,"validation":6},{"ca":"SECOM Trust Systems CO., LTD.","misissuance":20,"revocation":7,"governance":12,"validation":0},{"ca":"Telia Company","misissuance":20,"revocation":3,"governance":12,"validation":2},{"ca":"China Financial Certification Authority (CFCA)","misissuance":18,"revocation":6,"governance":12,"validation":0},{"ca":"SSL.com","misissuance":9,"revocation":9,"governance":5,"validation":13},{"ca":"D-TRUST","misissuance":19,"revocation":8,"governance":7,"validation":0},{"ca":"Certigna","misissuance":11,"revocation":4,"governance":14,"validation":1},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","misissuance":10,"revocation":7,"governance":13,"validation":0},{"ca":"Deutsche Telekom Security GmbH","misissuance":19,"revocation":5,"governance":4,"validation":1},{"ca":"Chunghwa Telecom","misissuance":4,"revocation":4,"governance":17,"validation":4},{"ca":"Actalis","misissuance":11,"revocation":10,"governance":6,"validation":0},{"ca":"Izenpe S.A.","misissuance":12,"revocation":4,"governance":6,"validation":1},{"ca":"certSIGN","misissuance":8,"revocation":3,"governance":12,"validation":0},{"ca":"eMudhra Technologies Limited","misissuance":5,"revocation":8,"governance":9,"validation":1},{"ca":"HARICA","misissuance":9,"revocation":5,"governance":3,"validation":4},{"ca":"Krajowa Izba Rozliczeniowa S.A. (KIR)","misissuance":10,"revocation":5,"governance":5,"validation":0},{"ca":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","misissuance":8,"revocation":1,"governance":10,"validation":1},{"ca":"Viking Cloud, Inc.","misissuance":7,"revocation":4,"governance":8,"validation":1},{"ca":"Microsec Ltd.","misissuance":10,"revocation":3,"governance":5,"validation":0},{"ca":"Amazon Trust Services","misissuance":5,"revocation":2,"governance":5,"validation":5},{"ca":"Taiwan-CA Inc. (TWCA)","misissuance":9,"revocation":3,"governance":4,"validation":0},{"ca":"WISeKey","misissuance":9,"revocation":5,"governance":1,"validation":1},{"ca":"Buypass","misissuance":5,"revocation":4,"governance":4,"validation":3},{"ca":"Apple Inc.","misissuance":2,"revocation":7,"governance":5,"validation":1},{"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","misissuance":1,"revocation":1,"governance":11,"validation":0},{"ca":"Disig, a.s.","misissuance":5,"revocation":1,"governance":6,"validation":0},{"ca":"Certainly LLC","misissuance":1,"revocation":6,"governance":3,"validation":2},{"ca":"iTrusChina","misissuance":2,"revocation":2,"governance":5,"validation":1},{"ca":"NAVER Cloud Trust Services","misissuance":6,"revocation":0,"governance":3,"validation":1},{"ca":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","misissuance":3,"revocation":2,"governance":4,"validation":0},{"ca":"Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA))","misissuance":5,"revocation":3,"governance":0,"validation":1},{"ca":"Consorci AOC","misissuance":3,"revocation":2,"governance":3,"validation":0},{"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","misissuance":5,"revocation":2,"governance":1,"validation":0},{"ca":"CommScope","misissuance":2,"revocation":1,"governance":3,"validation":2},{"ca":"Eviden","misissuance":3,"revocation":0,"governance":3,"validation":0},{"ca":"Agence Nationale de Certification Electronique","misissuance":2,"revocation":3,"governance":0,"validation":0},{"ca":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","misissuance":3,"revocation":1,"governance":0,"validation":0},{"ca":"Visa","misissuance":1,"revocation":1,"governance":1,"validation":0},{"ca":"Cybertrust Japan Co., Ltd.","misissuance":0,"revocation":2,"governance":1,"validation":0},{"ca":"TrustAsia Technologies, Inc.","misissuance":1,"revocation":0,"governance":1,"validation":1},{"ca":"SK ID Solutions AS","misissuance":1,"revocation":0,"governance":1,"validation":0},{"ca":"PostSignum","misissuance":2,"revocation":0,"governance":0,"validation":0}],"categories":[{"category":"Misissuance","count":611},{"category":"Governance","count":505},{"category":"Revocation","count":332},{"category":"Validation","count":124}],"whiteboardTags":{"ca-compliance":1539,"ov-misissuance":329,"policy-failure":195,"ev-misissuance":181,"disclosure-failure":139,"ocsp-failure":133,"dv-misissuance":123,"audit-finding":108,"leaf-revocation-delay":102,"crl-failure":89,"ca-misissuance":62,"audit-failure":48,"uncategorized":45,"smime-misissuance":41,"external":32,"ca-revocation-delay":31,"audit-delay":17,"covid-19":7,"disclosure failure":7,"__-misissuance":6,"ca-onecrl":4,"ca-investigation":3,"remediation-accepted":3,"ca-infosharing":2,"ca compliance":2,"close on 2026-09-21":2,"iv-misissuance":1,"ca-informational":1,"close on 2025-06-03":1,"close on 2025-12-10":1,"close on 2025-12-11":1,"close on 2025-12-08":1,"close on 2026-07-16":1,"code-signing-misissuance":1,"cs-misissuance":1,"close on 2026-09-15":1,"close as INVALID on 2026-09-21":1}},"brThresholds":[{"from":"2020-09-01","days":398,"label":"398 days"},{"from":"2026-03-15","days":200,"label":"200 days"},{"from":"2027-03-15","days":100,"label":"100 days"},{"from":"2029-03-15","days":47,"label":"47 days"}],"brReadiness":{"cas":[{"ca":"OISTE","useDays":319,"status":"subscriber_risk","share":0.0003,"unexpiredCerts":4820},{"ca":"HARICA","useDays":303,"status":"subscriber_risk","share":0.069,"unexpiredCerts":1001314},{"ca":"eMudhra Technologies Limited","useDays":244,"status":"subscriber_risk","share":0.0059,"unexpiredCerts":85190},{"ca":"TrustAsia Technologies, Inc.","useDays":185,"status":"risk_2027","share":0.0811,"unexpiredCerts":1177286},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","useDays":147,"status":"risk_2027","share":0.002,"unexpiredCerts":29054},{"ca":"D-Trust","useDays":141,"status":"risk_2027","share":0.005,"unexpiredCerts":72138},{"ca":"IdenTrust Services, LLC","useDays":140,"status":"risk_2027","share":1.2468,"unexpiredCerts":18091007},{"ca":"Amazon Trust Services","useDays":132,"status":"risk_2027","share":1.2304,"unexpiredCerts":17853684},{"ca":"GoDaddy","useDays":94,"status":"risk_2029","share":9.7172,"unexpiredCerts":141001293},{"ca":"Telia Company","useDays":90,"status":"risk_2029","share":0.0025,"unexpiredCerts":35930},{"ca":"Government of Spain, Autoritat de Certificaci\u00f3 de la Comunitat Valenciana (ACCV)","useDays":87,"status":"risk_2029","share":0.0003,"unexpiredCerts":4742},{"ca":"NAVER Cloud Trust Services","useDays":82,"status":"risk_2029","share":0.0004,"unexpiredCerts":5722},{"ca":"Microsec Ltd.","useDays":81,"status":"risk_2029","share":0.0002,"unexpiredCerts":2837},{"ca":"SwissSign AG","useDays":80,"status":"risk_2029","share":0.0029,"unexpiredCerts":42215},{"ca":"Actalis","useDays":78,"status":"risk_2029","share":0.1082,"unexpiredCerts":1569860},{"ca":"Open Access Technology International, Inc. (OATI)","useDays":72,"status":"risk_2029","share":0.0002,"unexpiredCerts":2464},{"ca":"SSL.com","useDays":70,"status":"risk_2029","share":1.6925,"unexpiredCerts":24558565},{"ca":"certSIGN","useDays":70,"status":"risk_2029","share":0.0003,"unexpiredCerts":3862},{"ca":"China Financial Certification Authority (CFCA)","useDays":67,"status":"risk_2029","share":0.0004,"unexpiredCerts":5348},{"ca":"Government of Spain, F\u00e1brica Nacional de Moneda y Timbre (FNMT)","useDays":66,"status":"risk_2029","share":0.0002,"unexpiredCerts":3099},{"ca":"DigiCert","useDays":64,"status":"risk_2029","share":16.273,"unexpiredCerts":236129763},{"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","useDays":63,"status":"risk_2029","share":0.0002,"unexpiredCerts":2995},{"ca":"Cybertrust Japan Co., Ltd.","useDays":61,"status":"risk_2029","share":0.0026,"unexpiredCerts":37213},{"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","useDays":61,"status":"risk_2029","share":0.0002,"unexpiredCerts":2400},{"ca":"Deutsche Telekom Security GmbH","useDays":59,"status":"risk_2029","share":0.0015,"unexpiredCerts":21277},{"ca":"Microsoft Corporation","useDays":53,"status":"risk_2029","share":3.8944,"unexpiredCerts":56509537},{"ca":"Taiwan-CA Inc. (TWCA)","useDays":52,"status":"risk_2029","share":0.0037,"unexpiredCerts":52995},{"ca":"Google Trust Services LLC","useDays":48,"status":"risk_2029","share":21.1087,"unexpiredCerts":306298106},{"ca":"Autoridad de Certificacion Firmaprofesional","useDays":46,"status":"compliant","share":0.0001,"unexpiredCerts":1341},{"ca":"Asseco Data Systems S.A.","useDays":41,"status":"compliant","share":0.0482,"unexpiredCerts":698969},{"ca":"WISeKey","useDays":40,"status":"compliant","share":0.0001,"unexpiredCerts":1827},{"ca":"SECOM Trust Systems Co., Ltd.","useDays":28,"status":"compliant","share":0.0027,"unexpiredCerts":39341},{"ca":"Sectigo","useDays":26,"status":"compliant","share":7.2922,"unexpiredCerts":105812896},{"ca":"Internet Security Research Group","useDays":20,"status":"compliant","share":37.0751,"unexpiredCerts":537978167},{"ca":"GlobalSign nv-sa","useDays":11,"status":"compliant","share":0.1112,"unexpiredCerts":1613716},{"ca":"Certainly LLC","useDays":2,"status":"compliant","share":0.0046,"unexpiredCerts":66926}],"totalActiveTls":36,"subscriberRisk200d":3,"subscriberRisk100d":5,"ready47d":8,"medianUseDays":70},"cryptoSummary":{"totalRoots":329,"caCount":89,"keyFamilies":{"RSA":235,"ECC":94},"keySizes":{"RSA-4096":182,"P-384":83,"RSA-2048":51,"P-521":6,"P-256":5,"RSA-3072":2},"sigHashes":{"SHA-384":146,"SHA-256":115,"SHA-1":38,"SHA-512":30}},"rootAlgorithms":{"totalRoots":329,"byKeyFamily":{"RSA":235,"ECC":94},"byKeyBits":{"4096":182,"384":83,"2048":51,"521":6,"256":5,"3072":2},"bySigHash":{"SHA-384":146,"SHA-256":115,"SHA-1":38,"SHA-512":30},"tlsCapable":198,"evCapable":106,"sha1Roots":38,"perCA":[{"rsa":29,"ecc":11,"roots":40,"crtshUrl":"https://crt.sh/?CAName=DigiCert"},{"rsa":18,"ecc":8,"roots":26,"crtshUrl":"https://crt.sh/?CAName=Sectigo"},{"rsa":10,"ecc":8,"roots":18,"crtshUrl":"https://crt.sh/?CAName=SSL.com"},{"rsa":9,"ecc":7,"roots":16,"crtshUrl":"https://crt.sh/?CAName=eMudhra%20Technologies%20Limited"},{"rsa":10,"ecc":6,"roots":16,"crtshUrl":"https://crt.sh/?CAName=GlobalSign%20nv-sa"},{"rsa":7,"ecc":4,"roots":11,"crtshUrl":"https://crt.sh/?CAName=IdenTrust%20Services%2C%20LLC"},{"rsa":4,"ecc":6,"roots":10,"crtshUrl":"https://crt.sh/?CAName=Google%20Trust%20Services%20LLC"},{"rsa":6,"ecc":4,"roots":10,"crtshUrl":"https://crt.sh/?CAName=Telia%20Company"},{"rsa":5,"ecc":4,"roots":9,"crtshUrl":"https://crt.sh/?CAName=Actalis"},{"rsa":4,"ecc":4,"roots":8,"crtshUrl":"https://crt.sh/?CAName=HARICA"},{"rsa":5,"ecc":2,"roots":7,"crtshUrl":"https://crt.sh/?CAName=Asseco%20Data%20Systems%20S.A."},{"rsa":4,"ecc":3,"roots":7,"crtshUrl":"https://crt.sh/?CAName=OISTE"},{"rsa":4,"ecc":2,"roots":6,"crtshUrl":"https://crt.sh/?CAName=Deutsche%20Telekom%20Security%20GmbH"},{"rsa":6,"ecc":0,"roots":6,"crtshUrl":"https://crt.sh/?CAName=GoDaddy"},{"rsa":3,"ecc":3,"roots":6,"crtshUrl":"https://crt.sh/?CAName=Microsec%20Ltd."},{"rsa":3,"ecc":3,"roots":6,"crtshUrl":"https://crt.sh/?CAName=TrustAsia%20Technologies%2C%20Inc."},{"rsa":3,"ecc":2,"roots":5,"crtshUrl":"https://crt.sh/?CAName=Amazon%20Trust%20Services"},{"rsa":3,"ecc":2,"roots":5,"crtshUrl":"https://crt.sh/?CAName=Atos"},{"rsa":3,"ecc":2,"roots":5,"crtshUrl":"https://crt.sh/?CAName=Prvn%C3%AD%20certifika%C4%8Dn%C3%AD%20autorita%2C%20a.s."},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=AC%20Camerfirma%2C%20S.A."},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Chunghwa%20Telecom"},{"rsa":3,"ecc":1,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Cybertrust%20Japan%20/%20JCSI"},{"rsa":2,"ecc":2,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20F%C3%A1brica%20Nacional%20de%20Moneda%20y%20Timbre%20%28FNMT%29"},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=SwissSign%20AG"},{"rsa":4,"ecc":0,"roots":4,"crtshUrl":"https://crt.sh/?CAName=Taiwan-CA%20Inc.%20%28TWCA%29"},{"rsa":3,"ecc":0,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Buypass"},{"rsa":3,"ecc":0,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Disig%2C%20a.s."},{"rsa":3,"ecc":0,"roots":3,"crtshUrl":"https://crt.sh/?CAName=e-commerce%20monitoring%20GmbH"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Finland%2C%20Population%20Register%20Centre%E2%80%99s%20%28V%C3%A4est%C3%B6rekisterikeskus%2C%20VRK%29"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Microsoft%20Corporation"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=NAVER%20Cloud%20Trust%20Services"},{"rsa":2,"ecc":1,"roots":3,"crtshUrl":"https://crt.sh/?CAName=Visa"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=A-Trust"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificacion%20Firmaprofesional"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=BEIJING%20CERTIFICATE%20AUTHORITY%20Co.%2C%20Ltd."},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Certainly%20LLC"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Certigna"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=certSIGN"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=China%20Financial%20Certification%20Authority%20%28CFCA%29"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=DigitalSign%20-%20Certificadora%20Digital%2C%20S.A."},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Brazil%2C%20Instituto%20Nacional%20de%20Tecnologia%20da%20Informa%C3%A7%C3%A3o%20%28ITI%29"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Hong%20Kong%20%28SAR%29%2C%20Hongkong%20Post%2C%20Certizen"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20India%2C%20Ministry%20of%20Communications%20%26%20Information%20Technology%2C%20Controller%20of%20Certifying%20Authorities%20%28CCA%29"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Internet%20Security%20Research%20Group"},{"rsa":1,"ecc":1,"roots":2,"crtshUrl":"https://crt.sh/?CAName=iTrusChina%20Co.%2C%20Ltd."},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=LAWtrust"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Netlock"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Notarius"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Open%20Access%20Technology%20International%2C%20Inc.%20%28OATI%29"},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Shanghai%20Electronic%20Certification%20Authority%20Co.%2C%20Ltd."},{"rsa":2,"ecc":0,"roots":2,"crtshUrl":"https://crt.sh/?CAName=Thailand%20National%20Root%20Certificate%20Authority%20%28Electronic%20Transactions%20Development%20Agency%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Agence%20Nationale%20de%20Certification%20Electronique"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Autoridad%20de%20Certificaci%C3%B3n%20%28ANF%20AC%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Carillon%20Information%20Security%20Inc."},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=ComSign"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Consejo%20General%20de%20la%20Abogac%C3%ADa%20Espa%C3%B1ola"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Consorci%20Administraci%C3%B3%20Oberta%20de%20Catalunya%20%28Consorci%20AOC%2C%20CATCert%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Department%20of%20Defence%20Australia"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Docaposte%20Certinomis%20SAS"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=EDICOM"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Financijska%20agencija%20%28Fina%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Global%20Digital%20Cybersecurity%20Authority%20Co.%2C%20Ltd.%20%28Formerly%20Guang%20Dong%20Certificate%20Authority%20%28GDCA%29%29"},{"rsa":0,"ecc":1,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Japan%2C%20Digital%20Agency"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Korea%2C%20KLID"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Spain%2C%20Autoritat%20de%20Certificaci%C3%B3%20de%20la%20Comunitat%20Valenciana%20%28ACCV%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Sweden%20%28F%C3%B6rs%C3%A4kringskassan%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20The%20Netherlands%2C%20PKIoverheid%20%28Logius%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Government%20of%20Turkey%2C%20Kamu%20Sertifikasyon%20Merkezi%20%28Kamu%20SM%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Halcom%20D.D."},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Izenpe%20S.A."},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Krajowa%20Izba%20Rozliczeniowa%20S.A.%20%28KIR%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Macao%20Post%20and%20Telecommunications%20Bureau"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=MULTICERT"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Netrust%20Pte%20Ltd"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=PostSignum"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Saudi%20Data%20and%20Artificial%20Intelligence%20Authority%20%28SDAIA%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=SI-TRUST"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Swiss%20BIT%2C%20Swiss%20Federal%20Office%20of%20Information%20Technology%2C%20Systems%20and%20Telecommunication%20%28FOITT%29"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=TrustFactory%28Pty%29Ltd"},{"rsa":1,"ecc":0,"roots":1,"crtshUrl":"https://crt.sh/?CAName=Zetes"}],"lookupUrl":"https://crt.sh/?CAName={caOwner}","note":"Summary view. Full per-root detail in llm_snapshot_risk.json."},"distrustEvents":[{"ca":"DigiNotar","caOwner":"DigiNotar","crtshUrl":"https://crt.sh/?CAName=DigiNotar","year":2011,"country":"Netherlands","compliancePosture":"willful_circumvention","distrustPathway":"immediate","responseQuality":"moot","reasonTags":["infrastructure_compromise","rogue_certificate_issuance","concealed_breach_or_incident","certificates_used_for_mitm"],"summary":"CA infrastructure was fully compromised. Attacker issued 531+ fraudulent certificates including *.google.com, used in MITM surveillance of Iranian users. CA concealed the breach for weeks. Declared bankruptcy after distrust.","distrustDates":{"chrome":"2011-08-29","mozilla":"2011-09-02","apple":"2011-09-09","microsoft":"2011-09-13"},"classificationTier":"curated","postureEvidence":"Concealed breach for weeks while fraudulent certs were actively used for surveillance.","tagEvidence":{"infrastructure_compromise":"Curated from root program announcements","rogue_certificate_issuance":"Curated from root program announcements","concealed_breach_or_incident":"Curated from root program announcements","certificates_used_for_mitm":"Curated from root program announcements"},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2011-08-29","runwayDays":null},"references":{"rootProgramAnnouncements":["https://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/","https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-091511/"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/eFp_xmfNhAw"],"ccadbThreads":[],"articles":[{"url":"https://www.enisa.europa.eu/sites/default/files/all_files/Operation_Black_Tulip_v2.pdf","source":"ENISA","title":"Operation Black Tulip: Certificate authorities lose authority"},{"url":"https://www.theregister.com/2011/09/06/diginotar_audit_damning_fail/","source":"The Register","title":"Inside Operation Black Tulip: DigiNotar hack analysed"},{"url":"https://en.wikipedia.org/wiki/DigiNotar","source":"Wikipedia","title":"DigiNotar"},{"url":"https://digitalcommons.usf.edu/cgi/viewcontent.cgi?article=1246&context=jss","source":"Journal of Strategic Security","title":"DigiNotar: Dissecting the First Dutch Digital Disaster"}]}},{"ca":"ANSSI","caOwner":"Government of France (ANSSI, DCSSI)","crtshUrl":"https://crt.sh/?CAName=Government%20of%20France%20%28ANSSI%2C%20DCSSI%29","year":2013,"country":"France","compliancePosture":"accidental","distrustPathway":"triggered","responseQuality":"cooperative","reasonTags":["unauthorized_delegation","rogue_certificate_issuance","certificates_used_for_mitm"],"summary":"Government CA issued intermediate certificate to network appliance company for traffic inspection. Used to issue MITM certificate for Google domains. ANSSI cooperated, certificate was revoked. Distrust limited to specific intermediate, not full root removal.","distrustDates":{"chrome":"2013-12-09","mozilla":"2013-12-09","apple":"2013-12-09","microsoft":"2013-12-09"},"classificationTier":"curated","postureEvidence":"Government CA delegated cert to network appliance company. Didn't understand WebPKI constraints on delegation.","tagEvidence":{"unauthorized_delegation":"Curated from root program announcements","rogue_certificate_issuance":"Curated from root program announcements","certificates_used_for_mitm":"Curated from root program announcements"},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2013-06-01","runwayDays":null},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2013/12/further-improving-digital-certificate.html","https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/"],"mdspThreads":[],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2013/12/further-improving-digital-certificate.html","source":"Chrome Blog","title":"Further improving digital certificate security"},{"url":"https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/","source":"Mozilla Blog","title":"Revoking trust in one ANSSI certificate"}]}},{"ca":"India CCA (NIC)","caOwner":"India CCA","crtshUrl":"https://crt.sh/?CAName=India%20CCA","year":2014,"country":"IN","compliancePosture":"negligent_noncompliance","distrustPathway":"triggered","responseQuality":"inadequate","reasonTags":["unauthorized_certificate","government_ca","lack_of_controls"],"summary":"Indian government CA (National Informatics Centre) issued unauthorized certificates for Google domains. Chrome, Mozilla, and Apple constrained or removed trust. Microsoft has not acted.","distrustDates":{"chrome":"2014-07-12","mozilla":"2014-07-14","apple":"2014-07-14"},"classificationTier":"curated","postureEvidence":"NIC intermediate CA issued unauthorized Google certificates.","tagEvidence":{},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2014-07-12","runwayDays":null}},{"ca":"CNNIC","caOwner":"China Internet Network Information Center (CNNIC)","crtshUrl":"https://crt.sh/?CAName=China%20Internet%20Network%20Information%20Center%20%28CNNIC%29","year":2015,"country":"China","compliancePosture":"negligent_noncompliance","distrustPathway":"triggered","responseQuality":"inadequate","reasonTags":["unauthorized_delegation","rogue_certificate_issuance","inadequate_incident_response","certificates_used_for_mitm"],"summary":"Issued unconstrained intermediate certificate to MCS Holdings, an Egyptian company that used it as a MITM proxy to issue unauthorized certificates for Google domains.","distrustDates":{"chrome":"2015-04-01","mozilla":"2015-04-02","apple":"2015-04-02","microsoft":"2015-04-02"},"classificationTier":"curated","postureEvidence":"Issued unconstrained intermediate to MCS Holdings without adequate oversight. MCS ran a MITM proxy.","tagEvidence":{"unauthorized_delegation":"Curated from root program announcements","rogue_certificate_issuance":"Curated from root program announcements","inadequate_incident_response":"Curated from root program announcements","certificates_used_for_mitm":"Curated from root program announcements"},"timeline":{"firstBugDate":null,"lastBugDate":null,"distrustDate":"2015-04-01","runwayDays":null},"references":{"rootProgramAnnouncements":["https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/","https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Z5701nXiDqA"],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html","source":"Chrome Blog","title":"Maintaining digital certificate security"},{"url":"https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/","source":"Mozilla Blog","title":"Distrusting new CNNIC certificates"}]}},{"ca":"WoSign","caOwner":"WoSign CA Limited","crtshUrl":"https://crt.sh/?CAName=WoSign%20CA%20Limited","year":2016,"country":"China","compliancePosture":"willful_circumvention","distrustPathway":"immediate","responseQuality":"moot","reasonTags":["baseline_requirements_violations","rogue_certificate_issuance","active_deception","hidden_corporate_changes","validation_bypass"],"summary":"WoSign was distrusted for systematic rule circumvention including backdating SHA-1 certificates, issuing unauthorized certificates, and concealing their acquisition of StartCom. They deliberately built systems to violate browser restrictions and actively deceived the community about their operations.","distrustDates":{"chrome":"2016-10-31","mozilla":"2016-10-24","apple":"2016-12-01","microsoft":"2017-01-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2019-02-05","lastBugDate":"2019-02-05","distrustDate":"2016-06-01","runwayDays":-979},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/k9PBmyLCi8I","https://groups.google.com/g/mozilla.dev.security.policy/c/1XI3Y7PJ1Uc","https://groups.google.com/g/mozilla.dev.security.policy/c/BV5XyFJLnQM","https://groups.google.com/g/mozilla.dev.security.policy/c/VUj2glQYxLc"],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html","source":"Chrome Blog","title":"Distrusting WoSign and StartCom Certificates"},{"url":"https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/","source":"Mozilla Blog","title":"Distrusting New WoSign and StartCom Certificates"},{"url":"https://en.wikipedia.org/wiki/WoSign","source":"Wikipedia","title":"WoSign"}]}},{"ca":"StartCom","caOwner":"Start Commercial (StartCom) Ltd.","crtshUrl":"https://crt.sh/?CAName=Start%20Commercial%20%28StartCom%29%20Ltd.","year":2016,"country":"Israel","compliancePosture":"willful_circumvention","distrustPathway":"immediate","responseQuality":"moot","reasonTags":["active_deception","hidden_corporate_changes","rogue_certificate_issuance","baseline_requirements_violations","pattern_of_issues","validation_bypass"],"summary":"StartCom was distrusted for concealing its acquisition by WoSign while maintaining false appearance of independence. Post-distrust bugs show continued attempts to circumvent restrictions through proxy issuance and certificate manipulation, demonstrating willful violation of trust boundaries.","distrustDates":{"chrome":"2016-10-31","mozilla":"2016-10-24","apple":"2016-12-01","microsoft":"2017-01-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-03-25","lastBugDate":"2019-02-05","distrustDate":"2016-06-01","runwayDays":-297},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/TbDYE69YP8E"],"ccadbThreads":[],"articles":[{"url":"https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html","source":"Chrome Blog","title":"Distrusting WoSign and StartCom Certificates"},{"url":"https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/","source":"Mozilla Blog","title":"Distrusting New WoSign and StartCom Certificates"},{"url":"https://en.wikipedia.org/wiki/StartCom","source":"Wikipedia","title":"StartCom"}]}},{"ca":"Symantec","caOwner":"Symantec","crtshUrl":"https://crt.sh/?CAName=Symantec","year":2017,"country":"United States","compliancePosture":"argumentative_noncompliance","distrustPathway":"negotiated","responseQuality":"inadequate","reasonTags":["unauthorized_delegation","pattern_of_issues","validation_bypass","lack_of_meaningful_improvement","minimized_severity","baseline_requirements_violations","willful_misissuance"],"summary":"Google documented years of misissuance incidents including test certificates, non-audited intermediates, and BR violations. DigiCert acquired Symantec's CA business and managed the transition. Gradual distrust over 12+ months with subscriber migration.","distrustDates":{"chrome":"2018-04-17","mozilla":"2018-10-01","apple":"2018-10-15","microsoft":"2018-10-15"},"classificationTier":"curated","postureEvidence":"Third-party RA program was knowingly structured to bypass validation controls. Repeatedly minimized severity and argued rules should not apply as written. Willful misissuance in training infrastructure. Pattern of argumentative engagement with root programs eroded confidence.","tagEvidence":{"unauthorized_delegation":"Curated from root program announcements","pattern_of_issues":"Curated from root program announcements","validation_bypass":"Curated from root program announcements","lack_of_meaningful_improvement":"Curated from root program announcements","minimized_severity":"Curated from root program announcements","baseline_requirements_violations":"Curated from root program announcements"},"timeline":{"firstBugDate":"2017-01-27","lastBugDate":"2017-11-27","distrustDate":"2018-10-09","runwayDays":620},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html"],"mdspThreads":["https://groups.google.com/g/mozilla.dev.security.policy/c/gLhzSzo-XFw"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4","https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html","source":"Chrome Blog","title":"Chrome's Plan to Distrust Symantec Certificates"},{"url":"https://arstechnica.com/information-technology/2017/03/google-takes-symantec-to-the-woodshed-for-mis-issuing-30000-https-certs/","source":"Ars Technica","title":"Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs"},{"url":"https://www.bleepingcomputer.com/news/security/google-outlines-ssl-apocalypse-for-symantec-certificates/","source":"Bleeping Computer","title":"Google Outlines SSL Apocalypse for Symantec Certificates"}]}},{"ca":"TurkTrust","caOwner":"TurkTrust","crtshUrl":"https://crt.sh/?CAName=TurkTrust","year":2018,"country":"Turkey","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","unauthorized_delegation","non_responsive_to_root_programs","audit_deficiencies","pattern_of_issues","rogue_certificate_issuance"],"summary":"TurkTrust was distrusted following a pattern of compliance failures including issuing non-audited, non-constrained intermediate certificates and failing to respond to root program surveys. The distrust was triggered by the 2012 incident where their operational mistake led to a fraudulent Google certificate, followed by ongoing compliance deficiencies.","distrustDates":{"chrome":"2018-06-01","mozilla":"2018-05-01","apple":"2018-06-01","microsoft":"2018-06-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-05-25","lastBugDate":"2018-02-17","distrustDate":"2018-06-01","runwayDays":372},"references":{"rootProgramAnnouncements":["https://krebsonsecurity.com/2013/01/turkish-registrar-enabled-phishers-to-spoof-google/"],"mdspThreads":[],"ccadbThreads":[],"articles":[{"url":"https://krebsonsecurity.com/2013/01/turkish-registrar-enabled-phishers-to-spoof-google/","source":"Krebs on Security","title":"Turkish CA enabled phishers to spoof Google"},{"url":"https://security.googleblog.com/2013/01/enhancing-digital-certificate-security.html","source":"Chrome Blog","title":"Enhancing digital certificate security"}]}},{"ca":"Certinomis","caOwner":"Docaposte Certinomis SAS","crtshUrl":"https://crt.sh/?CAName=Docaposte%20Certinomis%20SAS","year":2019,"country":"France","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","pattern_of_issues","lack_of_meaningful_improvement","inadequate_incident_response","non_responsive_to_root_programs"],"summary":"Certinomis was distrusted in 2019 following a sustained pattern of 20 documented incidents over 2+ years showing systematic BR violations including invalid DNS names, improper certificate profiles, and OCSP failures. Despite being aware of these issues through bug reports, the CA failed to implement effective systemic remediation, with the same violation categories recurring throughout the period.","distrustDates":{"chrome":"2019-07-01","mozilla":"2019-06-01","apple":"2019-07-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-02","lastBugDate":"2019-05-14","distrustDate":"2019-06-01","runwayDays":668},"references":{"rootProgramAnnouncements":["https://venafi.com/blog/mozilla-distrusts-certinomis-issued-certificates/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Ni4tS6OBBbw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/rmU311hOIIc"],"ccadbThreads":[],"articles":[{"url":"https://venafi.com/blog/mozilla-distrusts-certinomis-issued-certificates/","source":"Venafi","title":"Mozilla distrusts Certinomis issued certificates"}]}},{"ca":"PROCERT","caOwner":"PROCERT","crtshUrl":"https://crt.sh/?CAName=PROCERT","year":2020,"country":"Venezuela","compliancePosture":"demonstrated_incompetence","distrustPathway":"gradual","responseQuality":"non_responsive","reasonTags":["baseline_requirements_violations","non_responsive_to_root_programs","demonstrated_lack_of_understanding","limited_ecosystem_value"],"summary":"PROCERT was a Venezuelan CA that demonstrated incompetence through non-BR-compliant issuance and complete non-responsiveness to Mozilla's action items. The sparse 2017 bug trail with no CA engagement suggests an organization that lacked the operational capacity to participate meaningfully in the WebPKI ecosystem.","distrustDates":{"chrome":"2020-07-01","mozilla":"2020-06-01","apple":"2020-07-01","microsoft":"2020-07-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-16","lastBugDate":"2017-10-04","distrustDate":"2020-06-01","runwayDays":1020},"references":{"rootProgramAnnouncements":["https://venafi.com/blog/mozilla-distrusts-procert-local-certificate-authorities-have-global-impact/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Ni4tS6OBBbw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/lqZersN26VA"],"ccadbThreads":[],"articles":[{"url":"https://venafi.com/blog/mozilla-distrusts-procert-local-certificate-authorities-have-global-impact/","source":"Venafi","title":"Mozilla distrusts PROCERT: local CAs have global impact"}]}},{"ca":"Camerfirma","caOwner":"AC Camerfirma, S.A.","crtshUrl":"https://crt.sh/?CAName=AC%20Camerfirma%2C%20S.A.","year":2021,"country":"Spain","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","pattern_of_issues","lack_of_meaningful_improvement","unauthorized_delegation","audit_deficiencies","inadequate_incident_response"],"summary":"Camerfirma was distrusted after years of systematic Baseline Requirements violations, delayed revocations, and unauthorized subordinate CA issuance. Despite repeated incidents and Mozilla oversight, the CA failed to implement effective controls, with the same types of violations recurring over multiple years.","distrustDates":{"chrome":"2021-07-01","mozilla":"2021-06-01","apple":"2021-07-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-03-25","lastBugDate":"2021-04-09","distrustDate":"2021-06-01","runwayDays":1529},"references":{"rootProgramAnnouncements":["https://www.theregister.com/2021/02/02/chrome_camerfirma_certificates/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/Ni4tS6OBBbw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/dSeD3dgnpzk"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4"],"articles":[{"url":"https://www.theregister.com/2021/02/02/chrome_camerfirma_certificates/","source":"The Register","title":"Chrome and Mozilla distrust Camerfirma certificates"}]}},{"ca":"TrustCor","caOwner":"TrustCor Systems","crtshUrl":"https://crt.sh/?CAName=TrustCor%20Systems","year":2022,"country":"Canada","compliancePosture":"negligent_noncompliance","distrustPathway":"immediate","responseQuality":"cooperative","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","audit_deficiencies","ties_to_adversarial_entities","pattern_of_issues"],"summary":"TrustCor was distrusted in 2022 primarily due to discovered corporate ties to surveillance entities rather than the technical compliance issues shown in these 2019 Bugzilla reports. While they had routine compliance problems and delayed revocations, the fundamental issue was organizational trust incompatibility.","distrustDates":{"chrome":"2022-12-02","mozilla":"2022-12-01","apple":"2022-12-02","microsoft":"2023-02-28"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2019-03-04","lastBugDate":"2019-11-26","distrustDate":"2022-06-01","runwayDays":1185},"references":{"rootProgramAnnouncements":["https://www.ghacks.net/2022/12/02/mozilla-and-microsoft-distrust-trustcor-root-certificates-in-their-browsers/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4","https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://www.ghacks.net/2022/12/02/mozilla-and-microsoft-distrust-trustcor-root-certificates-in-their-browsers/","source":"gHacks","title":"Mozilla and Microsoft distrust TrustCor root certificates"},{"url":"https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-browser-mozilla/","source":"Washington Post","title":"TrustCor linked to intelligence operations"}]}},{"ca":"Visa","caOwner":"Visa","crtshUrl":"https://crt.sh/?CAName=Visa","year":2022,"country":"United States of America","compliancePosture":"negligent_noncompliance","distrustPathway":"gradual","responseQuality":"non_responsive","reasonTags":["baseline_requirements_violations","audit_deficiencies","non_responsive_to_root_programs","pattern_of_issues","limited_ecosystem_value"],"summary":"Visa demonstrated a pattern of BR violations and audit deficiencies from 2017-2020 while completely failing to engage with root programs or respond to identified issues. The CA showed no meaningful participation in the WebPKI ecosystem it was supposed to serve.","distrustDates":{"chrome":"2022-07-01","mozilla":"2022-06-01","apple":"2022-07-01"},"classificationTier":"medium_high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-16","lastBugDate":"2020-07-07","distrustDate":"2022-06-01","runwayDays":1750},"references":{"rootProgramAnnouncements":["https://www.feistyduck.com/newsletter/issue_45_visa_certificate_authority_in_trouble"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/yqALPG5PC4s","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/wOAsjdGla9g"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://www.feistyduck.com/newsletter/issue_45_visa_certificate_authority_in_trouble","source":"Feisty Duck","title":"Visa Certificate Authority in trouble"}]}},{"ca":"e-Tugra","caOwner":"E-Tugra","crtshUrl":"https://crt.sh/?CAName=E-Tugra","year":2023,"country":"Turkey","compliancePosture":"demonstrated_incompetence","distrustPathway":"triggered","responseQuality":"inadequate","reasonTags":["operational_security_failures","baseline_requirements_violations","pattern_of_issues","inadequate_incident_response","demonstrated_lack_of_understanding","non_responsive_to_root_programs","limited_ecosystem_value"],"summary":"E-Tugra was distrusted after security researcher Ian Carroll discovered severe operational security failures including default passwords and exposed administrative interfaces. The CA had a 4-year pattern of baseline requirements violations but the security research findings triggered immediate distrust action.","distrustDates":{"chrome":"2023-01-09","mozilla":"2023-01-16","apple":"2023-01-16","microsoft":"2023-03-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2018-02-17","lastBugDate":"2022-11-18","distrustDate":"2023-06-01","runwayDays":1930},"references":{"rootProgramAnnouncements":["https://ian.sh/etugra"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/SXAeHT04TFc"],"articles":[{"url":"https://ian.sh/etugra","source":"Ian Carroll","title":"Security research findings on e-Tugra"}]}},{"ca":"Ecommerce Monitoring","caOwner":"e-commerce monitoring GmbH","crtshUrl":"https://crt.sh/?CAName=e-commerce%20monitoring%20GmbH","year":2024,"country":"Austria","compliancePosture":"demonstrated_incompetence","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","inadequate_incident_response","demonstrated_lack_of_understanding","pattern_of_issues","lack_of_meaningful_improvement"],"summary":"Ecommerce Monitoring demonstrated fundamental operational incompetence through a sustained pattern of baseline requirements violations and delayed revocations spanning 2021-2024. Most notably, when asked for root cause analysis of incidents, they confused the investigative concept with their root certificate, revealing they didn't understand basic CA operational requirements.","distrustDates":{"chrome":"2024-07-01","mozilla":"2024-06-01","apple":"2024-07-01","microsoft":"2024-07-01"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2021-06-12","lastBugDate":"2024-05-17","distrustDate":"2024-06-01","runwayDays":1085},"references":{"rootProgramAnnouncements":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/HFMEAMUe7v4/"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/HFMEAMUe7v4/"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/wRs-zec8w7k","https://groups.google.com/a/ccadb.org/g/public/c/GmGydKS2lMA","https://groups.google.com/a/ccadb.org/g/public/c/xoCKQLlU1F4"],"articles":[{"url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/HFMEAMUe7v4/","source":"MDSP","title":"Ecommerce Monitoring removal discussion"}]}},{"ca":"Entrust","caOwner":"Entrust","crtshUrl":"https://crt.sh/?CAName=Entrust","year":2024,"country":"United States of America","compliancePosture":"argumentative_noncompliance","distrustPathway":"gradual","responseQuality":"inadequate","reasonTags":["baseline_requirements_violations","delayed_or_refused_revocation","argued_rules_dont_apply","recharacterized_incidents","minimized_severity","lack_of_meaningful_improvement","pattern_of_issues","inadequate_incident_response"],"summary":"Entrust demonstrated a multi-year pattern of baseline requirements violations, delayed revocations, and argumentative responses that prioritized justifying non-compliance over fixing issues. Chrome explicitly noted Entrust's pattern of arguing that established practices should not apply to their circumstances rather than taking responsibility for mistakes.","distrustDates":{"chrome":"2024-11-12","apple":"2024-11-15","mozilla":"2025-03-01","microsoft":"2025-04-16"},"classificationTier":"high","postureEvidence":"","tagEvidence":{},"timeline":{"firstBugDate":"2017-08-16","lastBugDate":"2024-04-06","distrustDate":"2024-11-11","runwayDays":2644},"references":{"rootProgramAnnouncements":["https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html"],"mdspThreads":["https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/LhTIUMFGHNw","https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/jCvkhBjg9Yw"],"ccadbThreads":["https://groups.google.com/a/ccadb.org/g/public/c/79fkkAXMLpY","https://groups.google.com/a/ccadb.org/g/public/c/YhpAYN5lRh0","https://groups.google.com/a/ccadb.org/g/public/c/tk2CV6Mc-xo"],"articles":[{"url":"https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html","source":"Chrome Blog","title":"Sustaining Digital Certificate Security"},{"url":"https://arstechnica.com/security/2025/06/chrome-boots-2-certificate-authorities-citing-a-lack-of-trust-and-confidence/","source":"Ars Technica","title":"Chrome boots certificate authorities citing lack of trust and confidence"},{"url":"https://www.theregister.com/2024/08/01/mozilla_entrust/","source":"The Register","title":"Mozilla follows Google in distrusting Entrust's TLS certs"},{"url":"https://blog.cloudflare.com/how-cloudflare-is-helping-domain-owners-with-the-upcoming-entrust-ca/","source":"Cloudflare Blog","title":"How Cloudflare is helping domain owners with the Entrust distrust"}]}}],"distrustStats":{"totalEvents":16,"postureDistribution":{"willful_circumvention":3,"accidental":1,"negligent_noncompliance":7,"argumentative_noncompliance":2,"demonstrated_incompetence":3},"avgIntervalYears":0.93,"avgIntervalMonths":11,"medianRunwayDays":1185,"maxRunwayDays":2644,"avgRunwayDays":1280,"responseDrivenPct":73},"governance":{"reportCard":{"chrome":{"enforcement":"15/15","firstPublicAction":7,"neverActed":0,"stillTrusts":0,"bugzillaCoverage":730,"bugzillaCoverageRecent":291,"substantiveOversight":293,"substantiveOversightRecent":112,"oversightComments":1944,"ballotsProposed":16,"voteParticipation":"9/14","substantiveBallots":12,"caOwners":44,"roots":101,"exclusiveRoots":0,"ungoverned_exclusive":0},"mozilla":{"enforcement":"15/15","firstPublicAction":8,"neverActed":0,"stillTrusts":0,"bugzillaCoverage":818,"bugzillaCoverageRecent":273,"substantiveOversight":249,"substantiveOversightRecent":47,"oversightComments":1804,"ballotsProposed":18,"voteParticipation":"14/14","substantiveBallots":15,"caOwners":50,"roots":172,"exclusiveRoots":10,"ungoverned_exclusive":2},"apple":{"enforcement":"15/15","firstPublicAction":0,"neverActed":0,"stillTrusts":0,"bugzillaCoverage":46,"bugzillaCoverageRecent":46,"substantiveOversight":6,"substantiveOversightRecent":6,"oversightComments":65,"ballotsProposed":11,"voteParticipation":"10/14","substantiveBallots":9,"caOwners":39,"roots":144,"exclusiveRoots":4,"ungoverned_exclusive":0},"microsoft":{"enforcement":"11/15","firstPublicAction":0,"neverActed":4,"stillTrusts":4,"bugzillaCoverage":0,"bugzillaCoverageRecent":0,"substantiveOversight":0,"substantiveOversightRecent":0,"oversightComments":0,"ballotsProposed":0,"voteParticipation":"4/14","substantiveBallots":6,"caOwners":77,"roots":331,"exclusiveRoots":158,"ungoverned_exclusive":30}},"meta":{"bugsTotal":1858,"bugsWithComments":1858,"totalCommentsAnalyzed":6175},"bugCreationByYear":[{"y":2014,"chrome":0,"mozilla":2,"apple":0,"microsoft":0,"other":1},{"y":2015,"chrome":0,"mozilla":0,"apple":0,"microsoft":0,"other":1},{"y":2016,"chrome":0,"mozilla":3,"apple":0,"microsoft":0,"other":2},{"y":2017,"chrome":0,"mozilla":83,"apple":0,"microsoft":0,"other":40},{"y":2018,"chrome":3,"mozilla":59,"apple":0,"microsoft":0,"other":46},{"y":2019,"chrome":18,"mozilla":61,"apple":6,"microsoft":2,"other":168},{"y":2020,"chrome":28,"mozilla":20,"apple":3,"microsoft":3,"other":183},{"y":2021,"chrome":6,"mozilla":16,"apple":2,"microsoft":8,"other":155},{"y":2022,"chrome":0,"mozilla":10,"apple":4,"microsoft":0,"other":92},{"y":2023,"chrome":6,"mozilla":8,"apple":2,"microsoft":0,"other":117},{"y":2024,"chrome":3,"mozilla":5,"apple":0,"microsoft":1,"other":227},{"y":2025,"chrome":0,"mozilla":2,"apple":1,"microsoft":5,"other":215},{"y":2026,"chrome":0,"mozilla":0,"apple":9,"microsoft":12,"other":220}],"bugCreationTotals":{"chrome":64,"mozilla":269,"apple":27,"microsoft":31,"other":1467},"discoveryMethods":{"totals":{"external_researcher":306,"unknown":457,"community":277,"self_detected":437,"audit":127,"root_program":67},"by_year":[{"y":2014,"self_detected":0,"external_researcher":1,"root_program":0,"community":0,"audit":0,"unknown":2,"total":3},{"y":2015,"self_detected":0,"external_researcher":0,"root_program":0,"community":1,"audit":0,"unknown":0,"total":1},{"y":2016,"self_detected":0,"external_researcher":1,"root_program":0,"community":3,"audit":0,"unknown":1,"total":5},{"y":2017,"self_detected":13,"external_researcher":52,"root_program":1,"community":21,"audit":3,"unknown":9,"total":99},{"y":2018,"self_detected":13,"external_researcher":22,"root_program":12,"community":19,"audit":0,"unknown":20,"total":86},{"y":2019,"self_detected":25,"external_researcher":58,"root_program":4,"community":43,"audit":9,"unknown":74,"total":213},{"y":2020,"self_detected":8,"external_researcher":45,"root_program":4,"community":51,"audit":9,"unknown":91,"total":208},{"y":2021,"self_detected":16,"external_researcher":31,"root_program":4,"community":32,"audit":14,"unknown":67,"total":164},{"y":2022,"self_detected":15,"external_researcher":23,"root_program":7,"community":17,"audit":3,"unknown":34,"total":99},{"y":2023,"self_detected":23,"external_researcher":24,"root_program":10,"community":18,"audit":8,"unknown":46,"total":129},{"y":2024,"self_detected":82,"external_researcher":17,"root_program":3,"community":39,"audit":10,"unknown":54,"total":205},{"y":2025,"self_detected":101,"external_researcher":13,"root_program":12,"community":16,"audit":52,"unknown":25,"total":219},{"y":2026,"self_detected":141,"external_researcher":19,"root_program":10,"community":17,"audit":19,"unknown":34,"total":240}],"classified_bugs":1671,"excluded_distrusted":187,"corpus_note":"1671 bugs classified (excludes 187 distrusted-CA bugs). Corpus is larger than the 1,428-incident count in incidents.json because discovery classification runs on all non-distrusted bugs_raw entries, including ~75 sub-operator naming variants (e.g. 'DigiCert / ABB') that incidents.py normalizes into parent CA counts."},"programCommentSummary":{"chrome":{"total_comments":2130,"substantive_comments":2130,"workflow_events":0,"admin_comments":126,"oversight_comments":1944,"recent_oversight_comments":653,"technical_oversight_comments":617,"recent_technical_oversight_comments":213,"self_incident_comments":60,"recent_self_incident_comments":30,"bugs_engaged":746,"bugs_oversight":730,"recent_bugs_oversight":291,"bugs_technical_oversight":293,"recent_bugs_technical_oversight":112},"mozilla":{"total_comments":3263,"substantive_comments":3262,"workflow_events":1,"admin_comments":1458,"oversight_comments":1804,"recent_oversight_comments":441,"technical_oversight_comments":453,"recent_technical_oversight_comments":77,"self_incident_comments":0,"recent_self_incident_comments":0,"bugs_engaged":818,"bugs_oversight":818,"recent_bugs_oversight":273,"bugs_technical_oversight":249,"recent_bugs_technical_oversight":47},"apple":{"total_comments":204,"substantive_comments":204,"workflow_events":0,"admin_comments":3,"oversight_comments":65,"recent_oversight_comments":65,"technical_oversight_comments":11,"recent_technical_oversight_comments":11,"self_incident_comments":136,"recent_self_incident_comments":79,"bugs_engaged":64,"bugs_oversight":46,"recent_bugs_oversight":46,"bugs_technical_oversight":6,"recent_bugs_technical_oversight":6},"microsoft":{"total_comments":579,"substantive_comments":579,"workflow_events":0,"admin_comments":2,"oversight_comments":0,"recent_oversight_comments":0,"technical_oversight_comments":0,"recent_technical_oversight_comments":0,"self_incident_comments":577,"recent_self_incident_comments":524,"bugs_engaged":47,"bugs_oversight":0,"recent_bugs_oversight":0,"bugs_technical_oversight":0,"recent_bugs_technical_oversight":0}},"oversightConcentration":{"chrome":{"total_oversight_comments":1944,"unique_contributors":6,"top_contributor_pct":86,"top_3_contributors_pct":97,"top_contributor_email":"r**********@gmail.com","top_contributor_first_quarter":"2014-Q1","top_contributor_last_quarter":"2022-Q2"},"mozilla":{"total_oversight_comments":1804,"unique_contributors":9,"top_contributor_pct":47,"top_3_contributors_pct":90,"top_contributor_email":"w******@fastly.com","top_contributor_first_quarter":"2017-Q4","top_contributor_last_quarter":"2020-Q2"},"apple":{"total_oversight_comments":65,"unique_contributors":2,"top_contributor_pct":65,"top_3_contributors_pct":100,"top_contributor_email":"d**********@apple.com","top_contributor_first_quarter":"2025-Q4","top_contributor_last_quarter":"2026-Q3"},"microsoft":{"total_oversight_comments":0,"unique_contributors":0,"top_contributor_pct":0,"top_3_contributors_pct":0,"top_contributor_email":null,"top_contributor_first_quarter":null,"top_contributor_last_quarter":null}},"oversightQuarterly":[{"quarter":"2014-Q1","chrome_comments":3,"chrome_people":1,"mozilla_comments":2,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2015-Q3","chrome_comments":0,"chrome_people":0,"mozilla_comments":2,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2016-Q2","chrome_comments":0,"chrome_people":0,"mozilla_comments":2,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2016-Q3","chrome_comments":0,"chrome_people":0,"mozilla_comments":4,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2016-Q4","chrome_comments":2,"chrome_people":1,"mozilla_comments":2,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q1","chrome_comments":2,"chrome_people":1,"mozilla_comments":14,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q2","chrome_comments":1,"chrome_people":1,"mozilla_comments":22,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q3","chrome_comments":122,"chrome_people":1,"mozilla_comments":102,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2017-Q4","chrome_comments":37,"chrome_people":1,"mozilla_comments":139,"mozilla_people":4,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q1","chrome_comments":7,"chrome_people":1,"mozilla_comments":107,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q2","chrome_comments":13,"chrome_people":1,"mozilla_comments":92,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q3","chrome_comments":4,"chrome_people":1,"mozilla_comments":50,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2018-Q4","chrome_comments":15,"chrome_people":1,"mozilla_comments":60,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q1","chrome_comments":155,"chrome_people":1,"mozilla_comments":144,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q2","chrome_comments":121,"chrome_people":1,"mozilla_comments":122,"mozilla_people":4,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q3","chrome_comments":207,"chrome_people":1,"mozilla_comments":134,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2019-Q4","chrome_comments":113,"chrome_people":1,"mozilla_comments":77,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q1","chrome_comments":125,"chrome_people":1,"mozilla_comments":75,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q2","chrome_comments":95,"chrome_people":1,"mozilla_comments":83,"mozilla_people":3,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q3","chrome_comments":222,"chrome_people":2,"mozilla_comments":88,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2020-Q4","chrome_comments":47,"chrome_people":1,"mozilla_comments":42,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q1","chrome_comments":62,"chrome_people":1,"mozilla_comments":41,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q2","chrome_comments":156,"chrome_people":1,"mozilla_comments":29,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q3","chrome_comments":119,"chrome_people":1,"mozilla_comments":32,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2021-Q4","chrome_comments":36,"chrome_people":2,"mozilla_comments":12,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q1","chrome_comments":16,"chrome_people":1,"mozilla_comments":18,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q2","chrome_comments":11,"chrome_people":1,"mozilla_comments":15,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q3","chrome_comments":6,"chrome_people":2,"mozilla_comments":11,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2022-Q4","chrome_comments":11,"chrome_people":2,"mozilla_comments":11,"mozilla_people":2,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q1","chrome_comments":9,"chrome_people":2,"mozilla_comments":12,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q2","chrome_comments":22,"chrome_people":2,"mozilla_comments":10,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q3","chrome_comments":3,"chrome_people":2,"mozilla_comments":27,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2023-Q4","chrome_comments":4,"chrome_people":2,"mozilla_comments":19,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q1","chrome_comments":14,"chrome_people":2,"mozilla_comments":14,"mozilla_people":1,"apple_comments":1,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q2","chrome_comments":39,"chrome_people":2,"mozilla_comments":48,"mozilla_people":1,"apple_comments":17,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q3","chrome_comments":13,"chrome_people":2,"mozilla_comments":33,"mozilla_people":1,"apple_comments":3,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2024-Q4","chrome_comments":19,"chrome_people":3,"mozilla_comments":33,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q1","chrome_comments":20,"chrome_people":3,"mozilla_comments":40,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q2","chrome_comments":30,"chrome_people":2,"mozilla_comments":9,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q3","chrome_comments":22,"chrome_people":1,"mozilla_comments":9,"mozilla_people":1,"apple_comments":2,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2025-Q4","chrome_comments":11,"chrome_people":1,"mozilla_comments":1,"mozilla_people":1,"apple_comments":14,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2026-Q1","chrome_comments":14,"chrome_people":1,"mozilla_comments":9,"mozilla_people":1,"apple_comments":25,"apple_people":1,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2026-Q2","chrome_comments":5,"chrome_people":1,"mozilla_comments":3,"mozilla_people":1,"apple_comments":0,"apple_people":0,"microsoft_comments":0,"microsoft_people":0},{"quarter":"2026-Q3","chrome_comments":11,"chrome_people":1,"mozilla_comments":5,"mozilla_people":1,"apple_comments":3,"apple_people":1,"microsoft_comments":0,"microsoft_people":0}],"enforcement":{"chrome":{"acted":15,"total":15,"initiated":7,"followed":8,"still_trusts":[]},"mozilla":{"acted":15,"total":15,"initiated":8,"followed":7,"still_trusts":[]},"apple":{"acted":15,"total":15,"initiated":0,"followed":15,"still_trusts":[]},"microsoft":{"acted":11,"total":15,"initiated":0,"followed":11,"still_trusts":["India CCA (NIC)","Certinomis","Camerfirma","Visa"]}},"distrustEvents":[{"ca":"DigiNotar","year":2011,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"ANSSI","year":2013,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"India CCA (NIC)","year":2014,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"CNNIC","year":2015,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"WoSign / StartCom","year":2016,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Symantec","year":2017,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"TurkTrust","year":2018,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Certinomis","year":2019,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"PROCERT","year":2020,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Camerfirma","year":2021,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"TrustCor","year":2022,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Visa","year":2022,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"trusted"},{"ca":"e-Tugra","year":2023,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Ecommerce Monitoring","year":2024,"leader":"mozilla","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"},{"ca":"Entrust","year":2024,"leader":"chrome","chrome":"distrusted","mozilla":"distrusted","apple":"distrusted","microsoft":"distrusted"}],"storePosture":{"mozilla":{"owners":50,"roots":172,"exclusive_count":10,"gov_ca_count":15,"dark_matter":{"exclusive_cas":2,"exclusive_zero_incident":2,"zero_incident_cas":14,"total_cas":57,"exclusive_zero_pct":100.0,"zero_incident_pct":24.6}},"microsoft":{"owners":77,"roots":331,"exclusive_count":158,"gov_ca_count":29,"dark_matter":{"exclusive_cas":32,"exclusive_zero_incident":30,"zero_incident_cas":42,"total_cas":84,"exclusive_zero_pct":93.8,"zero_incident_pct":50.0}},"chrome":{"owners":44,"roots":101,"exclusive_count":0,"gov_ca_count":14,"dark_matter":{"exclusive_cas":0,"exclusive_zero_incident":0,"zero_incident_cas":10,"total_cas":50,"exclusive_zero_pct":0.0,"zero_incident_pct":20.0}},"apple":{"owners":39,"roots":144,"exclusive_count":4,"gov_ca_count":10,"dark_matter":{"exclusive_cas":0,"exclusive_zero_incident":0,"zero_incident_cas":10,"total_cas":45,"exclusive_zero_pct":0.0,"zero_incident_pct":22.2}}},"policyLeadership":{"by_working_group":{"server_certificate":{"programs":{"chrome":{"proposed":14,"endorsed":16,"voted":9,"absent":5,"ballots_with_votes":14},"mozilla":{"proposed":15,"endorsed":21,"voted":14,"absent":0,"ballots_with_votes":14},"apple":{"proposed":7,"endorsed":14,"voted":10,"absent":4,"ballots_with_votes":14},"microsoft":{"proposed":0,"endorsed":9,"voted":4,"absent":10,"ballots_with_votes":14}},"total_ballots":101,"prefix":"SC"},"code_signing":{"programs":{"chrome":{"proposed":0,"endorsed":0,"voted":0,"absent":1,"ballots_with_votes":1},"mozilla":{"proposed":0,"endorsed":0,"voted":0,"absent":1,"ballots_with_votes":1},"apple":{"proposed":0,"endorsed":1,"voted":0,"absent":1,"ballots_with_votes":1},"microsoft":{"proposed":6,"endorsed":12,"voted":1,"absent":0,"ballots_with_votes":1}},"total_ballots":35,"prefix":"CSC"},"smime":{"programs":{"chrome":{"proposed":0,"endorsed":1,"voted":1,"absent":13,"ballots_with_votes":14},"mozilla":{"proposed":0,"endorsed":5,"voted":14,"absent":0,"ballots_with_votes":14},"apple":{"proposed":0,"endorsed":4,"voted":8,"absent":6,"ballots_with_votes":14},"microsoft":{"proposed":0,"endorsed":0,"voted":1,"absent":13,"ballots_with_votes":14}},"total_ballots":18,"prefix":"SMC"},"network_security":{"programs":{"chrome":{"proposed":2,"endorsed":6,"voted":0,"absent":0,"ballots_with_votes":0},"mozilla":{"proposed":3,"endorsed":4,"voted":0,"absent":0,"ballots_with_votes":0},"apple":{"proposed":4,"endorsed":7,"voted":0,"absent":0,"ballots_with_votes":0},"microsoft":{"proposed":0,"endorsed":3,"voted":0,"absent":0,"ballots_with_votes":0}},"total_ballots":20,"prefix":"NS"}},"recent_votes":[{"id":"SC-095","title":"Ballot SC095v3: Clean-up 2025","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-097","title":"Ballot SC097: Sunset all remaining use of SHA-1 signatures in Certificates and CRLs","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"yes"},{"id":"SC-094","title":"Ballot SC094v2: DNSSEC exception in email DCV methods","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-096","title":"Ballot SC096: Carve-out for DNSSEC verification logging requirements","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-090","title":"Ballot SC-090: Gradually sunset all remaining email-based, phone-based, and \u2018crossover\u2019 validation methods from Sections 3.2.2.4 and 3.2.2.5","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-091","title":"Ballot SC-091: Sunset 3.2.2.5.3 Reverse Address Lookup Validation, proposal of new DNS-based validation using Persistent DCV TXT Record for IP addresses","result":"passed","chrome":"yes","mozilla":"yes","apple":"absent","microsoft":"absent"},{"id":"SC-086","title":"Ballot SC-086v3: Sunset the Inclusion of IP Reverse Address Domain Names","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-088","title":"Ballot SC-088v3: DNS TXT Record with Persistent Value DCV Method","result":"passed","chrome":"yes","mozilla":"yes","apple":"absent","microsoft":"absent"},{"id":"SC-092","title":"Ballot SC-092: Sunset use of Precertificate Signing CAs","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-089","title":"Ballot SC-089: Mass Revocation Planning","result":"passed","chrome":"absent","mozilla":"yes","apple":"absent","microsoft":"yes"},{"id":"SC-085","title":"Ballot SC-085v2: Require Validation of DNSSEC (when present) for CAA and DCV Lookups","result":"passed","chrome":"absent","mozilla":"yes","apple":"yes","microsoft":"absent"},{"id":"SC-081","title":"Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"yes"},{"id":"SC-084","title":"Ballot SC084: DNS Labeled with ACME Account ID Validation Method","result":"passed","chrome":"yes","mozilla":"yes","apple":"absent","microsoft":"yes"},{"id":"SC-083","title":"Ballot SC083v3: Winter 2024-2025 Cleanup Ballot","result":"passed","chrome":"yes","mozilla":"yes","apple":"yes","microsoft":"absent"}],"total_sc_ballots":101,"programs":{"chrome":{"proposed":16,"endorsed":22,"voted":9,"absent":5,"ballots_with_votes":14,"vote_participation_pct":64},"mozilla":{"proposed":18,"endorsed":25,"voted":14,"absent":0,"ballots_with_votes":14,"vote_participation_pct":100},"apple":{"proposed":11,"endorsed":21,"voted":10,"absent":4,"ballots_with_votes":14,"vote_participation_pct":71},"microsoft":{"proposed":0,"endorsed":12,"voted":4,"absent":10,"ballots_with_votes":14,"vote_participation_pct":29}}},"ballotClassification":{"total_ballots":174,"recent_count":50,"substantive_ballots":104,"pct_substantive":60,"browser_summary":{"chrome":{"total":16,"substantive":12,"pct_substantive":75,"endorsed":22,"by_category":{"uncategorized":3,"validation_improvement":3,"security_modernization":3,"transparency_profiles":3,"infrastructure":3,"cleanup":1}},"mozilla":{"total":18,"substantive":15,"pct_substantive":83,"endorsed":30,"by_category":{"incident_response":3,"governance":1,"security_modernization":2,"infrastructure":5,"validation_improvement":3,"transparency_profiles":2,"cleanup":1,"uncategorized":1}},"apple":{"total":11,"substantive":9,"pct_substantive":82,"endorsed":24,"by_category":{"validation_improvement":3,"security_modernization":1,"audit_standards":1,"infrastructure":4,"uncategorized":2}},"microsoft":{"total":6,"substantive":6,"pct_substantive":100,"endorsed":24,"by_category":{"security_modernization":1,"validation_improvement":4,"infrastructure":1}}},"top_ca_contributors":[{"name":"DigiCert","total":60,"substantive":29,"pct_substantive":48,"endorsed":39,"by_category":{"security_modernization":3,"cleanup":9,"incident_response":3,"uncategorized":8,"governance":14,"infrastructure":6,"transparency_profiles":5,"validation_improvement":10,"audit_standards":2}},{"name":"HARICA","total":14,"substantive":8,"pct_substantive":57,"endorsed":29,"by_category":{"validation_improvement":2,"transparency_profiles":2,"governance":3,"infrastructure":4,"uncategorized":1,"cleanup":2}},{"name":"Other CA","total":13,"substantive":5,"pct_substantive":38,"endorsed":0,"by_category":{"cleanup":5,"uncategorized":1,"validation_improvement":4,"governance":2,"infrastructure":1}},{"name":"Sectigo","total":10,"substantive":6,"pct_substantive":60,"endorsed":18,"by_category":{"infrastructure":3,"cleanup":3,"transparency_profiles":1,"uncategorized":1,"validation_improvement":1,"incident_response":1}},{"name":"Entrust","total":10,"substantive":3,"pct_substantive":30,"endorsed":22,"by_category":{"transparency_profiles":2,"uncategorized":5,"cleanup":2,"infrastructure":1}},{"name":"TrustCor","total":5,"substantive":5,"pct_substantive":100,"endorsed":8,"by_category":{"infrastructure":5}},{"name":"GlobalSign","total":5,"substantive":5,"pct_substantive":100,"endorsed":11,"by_category":{"validation_improvement":4,"security_modernization":1}},{"name":"Let's Encrypt","total":4,"substantive":1,"pct_substantive":25,"endorsed":4,"by_category":{"cleanup":2,"governance":1,"incident_response":1}},{"name":"SecureTrust","total":2,"substantive":0,"pct_substantive":0,"endorsed":0,"by_category":{"cleanup":2}}],"category_totals":{"security_modernization":{"browsers":7,"cas":4,"total":11},"validation_improvement":{"browsers":13,"cas":21,"total":34},"incident_response":{"browsers":3,"cas":5,"total":8},"transparency_profiles":{"browsers":5,"cas":10,"total":15},"infrastructure":{"browsers":13,"cas":20,"total":33},"cleanup":{"browsers":2,"cas":25,"total":27},"governance":{"browsers":1,"cas":20,"total":21},"audit_standards":{"browsers":1,"cas":2,"total":3},"uncategorized":{"browsers":6,"cas":16,"total":22}},"recent":{"total_ballots":50,"substantive_ballots":31,"browser_summary":{"chrome":{"total":9,"substantive":6,"pct_substantive":67,"endorsed":9,"by_category":{"uncategorized":3,"validation_improvement":3,"security_modernization":2,"transparency_profiles":1}},"mozilla":{"total":4,"substantive":3,"pct_substantive":75,"endorsed":15,"by_category":{"incident_response":2,"governance":1,"security_modernization":1}},"apple":{"total":7,"substantive":6,"pct_substantive":86,"endorsed":11,"by_category":{"validation_improvement":3,"security_modernization":1,"audit_standards":1,"infrastructure":1,"uncategorized":1}},"microsoft":{"total":0,"substantive":0,"pct_substantive":0,"endorsed":5,"by_category":{}}},"top_ca_contributors":[{"name":"Other CA","total":6,"substantive":3,"pct_substantive":50,"endorsed":0,"by_category":{"cleanup":1,"uncategorized":1,"validation_improvement":3,"governance":1}},{"name":"Sectigo","total":6,"substantive":3,"pct_substantive":50,"endorsed":7,"by_category":{"infrastructure":2,"cleanup":3,"transparency_profiles":1}},{"name":"DigiCert","total":5,"substantive":3,"pct_substantive":60,"endorsed":10,"by_category":{"security_modernization":2,"cleanup":1,"incident_response":1,"uncategorized":1}},{"name":"HARICA","total":4,"substantive":4,"pct_substantive":100,"endorsed":13,"by_category":{"validation_improvement":2,"transparency_profiles":2}},{"name":"Let's Encrypt","total":4,"substantive":1,"pct_substantive":25,"endorsed":2,"by_category":{"cleanup":2,"governance":1,"incident_response":1}},{"name":"Entrust","total":3,"substantive":2,"pct_substantive":67,"endorsed":3,"by_category":{"transparency_profiles":2,"uncategorized":1}},{"name":"SecureTrust","total":2,"substantive":0,"pct_substantive":0,"endorsed":0,"by_category":{"cleanup":2}}],"category_totals":{"security_modernization":{"browsers":4,"cas":2,"total":6},"validation_improvement":{"browsers":6,"cas":5,"total":11},"incident_response":{"browsers":2,"cas":2,"total":4},"transparency_profiles":{"browsers":1,"cas":5,"total":6},"infrastructure":{"browsers":1,"cas":2,"total":3},"cleanup":{"browsers":0,"cas":9,"total":9},"governance":{"browsers":1,"cas":2,"total":3},"audit_standards":{"browsers":1,"cas":0,"total":1},"uncategorized":{"browsers":4,"cas":3,"total":7}}}},"notableGaps":{"current":[{"ca":"TrustAsia Technologies, Inc.","rank":12,"certs":1177286,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["apple","microsoft"],"included_in":["chrome","mozilla"],"wait_years":5,"wait_source":"root_creation"},{"ca":"Certainly LLC","rank":19,"certs":66926,"stores":{"chrome":"included","mozilla":"included","apple":"included","microsoft":"not_included"},"missing_from":["microsoft"],"included_in":["chrome","mozilla","apple"],"wait_years":5,"wait_source":"root_creation"},{"ca":"Cybertrust Japan Co., Ltd.","rank":23,"certs":37213,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","apple"],"included_in":["mozilla","microsoft"],"wait_years":null,"wait_source":null},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","rank":25,"certs":29054,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Open Access Technology International, Inc. (OATI)","rank":36,"certs":2464,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":18,"wait_source":"root_creation"},{"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","rank":37,"certs":2400,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":9,"wait_source":"root_creation"},{"ca":"PostSignum","rank":40,"certs":963,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","rank":46,"certs":480,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":10,"wait_source":"root_creation"},{"ca":"Krajowa Izba Rozliczeniowa S.A. (KIR)","rank":47,"certs":475,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Prvn\u00ed certifika\u010dn\u00ed autorita, a.s.","rank":48,"certs":337,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Financijska agencija (Fina)","rank":49,"certs":313,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":11,"wait_source":"root_creation"},{"ca":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","rank":50,"certs":187,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":4,"wait_source":"root_creation"},{"ca":"A-Trust","rank":52,"certs":133,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Visa","rank":54,"certs":74,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":21,"wait_source":"root_creation"},{"ca":"Agence Nationale de Certification Electronique","rank":55,"certs":74,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["apple"],"included_in":["chrome","mozilla","microsoft"],"wait_years":7,"wait_source":"root_creation"},{"ca":"EDICOM","rank":56,"certs":52,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":12,"wait_source":"root_creation"},{"ca":"Government of Korea, KLID","rank":57,"certs":37,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":3,"wait_source":"root_creation"},{"ca":"iTrusChina Co., Ltd.","rank":58,"certs":17,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["apple","microsoft"],"included_in":["chrome","mozilla"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","rank":59,"certs":12,"stores":{"chrome":"included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["apple","microsoft"],"included_in":["chrome","mozilla"],"wait_years":7,"wait_source":"root_creation"},{"ca":"BEIJING CERTIFICATE AUTHORITY Co., Ltd.","rank":60,"certs":9,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"not_included"},"missing_from":["chrome","apple","microsoft"],"included_in":["mozilla"],"wait_years":7,"wait_source":"root_creation"},{"ca":"Netlock","rank":62,"certs":3,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","apple"],"included_in":["mozilla","microsoft"],"wait_years":18,"wait_source":"root_creation"},{"ca":"Cybertrust Japan / JCSI","rank":63,"certs":2,"stores":{"chrome":"not_included","mozilla":"included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","apple"],"included_in":["mozilla","microsoft"],"wait_years":8,"wait_source":"root_creation"},{"ca":"Entrust","rank":65,"certs":0,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"included","microsoft":"included"},"missing_from":["chrome","mozilla"],"included_in":["apple","microsoft"],"wait_years":16,"wait_source":"root_creation"},{"ca":"AC Camerfirma, S.A.","rank":79,"certs":0,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":18,"wait_source":"root_creation"},{"ca":"Consorci Administraci\u00f3 Oberta de Catalunya (Consorci AOC, CATCert)","rank":88,"certs":0,"stores":{"chrome":"not_included","mozilla":"not_included","apple":"not_included","microsoft":"included"},"missing_from":["chrome","mozilla","apple"],"included_in":["microsoft"],"wait_years":23,"wait_source":"root_creation"}],"distrust_divergences":[{"ca":"India CCA (NIC)","year":2014,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"chrome"},{"ca":"Certinomis","year":2019,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"mozilla"},{"ca":"Camerfirma","year":2021,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"mozilla"},{"ca":"Visa","year":2022,"distrusted_by":["chrome","mozilla","apple"],"still_trusted_by":["microsoft"],"leader":"mozilla"}],"historical":[{"ca":"Internet Security Research Group","common_name":"Let's Encrypt","rank":1,"certs_now":537978167,"timeline":{"root_created":"2015-06","mozilla_included":"2016-08","microsoft_included":"2018-08","apple_included":"2018-12"},"gap_years":2,"gap_description":"2-year gap between first inclusion (Mozilla Aug 2016) and Apple/Microsoft (late 2018). Relied on IdenTrust cross-sign.","resolved":true}]},"inclusionVelocity":{"mozilla_pending":[{"bug":1348774,"ca":"Thailand National Root CAs - G2 and G3","filed":"2017-03-20","days_waiting":3467,"stage":"verifying","request_type":"existing_ca"},{"bug":1449941,"ca":"Fina Root CA certificate","filed":"2018-03-29","days_waiting":3093,"stage":"unknown","request_type":"new_org"},{"bug":1532206,"ca":"MSC Trustgate root certificate(s)","filed":"2019-03-04","days_waiting":2753,"stage":"verifying","request_type":"new_org"},{"bug":1602415,"ca":"PostSignum Root QCA 4 and PostSignum Root QCA ECC R1","filed":"2019-12-09","days_waiting":2473,"stage":"verifying","request_type":"existing_ca"},{"bug":1674669,"ca":"Autoridade Certificadora Raiz Brasileira root certificate","filed":"2020-11-01","days_waiting":2145,"stage":"unknown","request_type":"existing_ca"},{"bug":1707136,"ca":"GSE SMIME Roots to Mozilla root store","filed":"2021-04-23","days_waiting":1972,"stage":"verifying","request_type":"new_org"},{"bug":1845081,"ca":"MOIS SSL Root CA","filed":"2023-07-24","days_waiting":1150,"stage":"unknown","request_type":"new_org"},{"bug":1870013,"ca":"Saudi National SSL root CA","filed":"2023-12-14","days_waiting":1007,"stage":"initial","request_type":"existing_ca"},{"bug":1883983,"ca":"SOLUTI GLOBAL ROOT CA","filed":"2024-03-06","days_waiting":924,"stage":"initial","request_type":"new_org"},{"bug":1889859,"ca":"emSign Single-purpose Root CA Certificates","filed":"2024-04-05","days_waiting":894,"stage":"unknown","request_type":"new_org"},{"bug":1938884,"ca":"NAVER Cloud Trust Services Root Certificates","filed":"2024-12-23","days_waiting":632,"stage":"verifying","request_type":"existing_ca"},{"bug":1948085,"ca":"Amazon EU Roots: RSA 2048 EU M1, ECDSA 256 EU M1, and ECDSA ","filed":"2025-02-13","days_waiting":580,"stage":"verifying","request_type":"existing_ca"},{"bug":1960408,"ca":"IdenTrust single purpose roots","filed":"2025-04-14","days_waiting":520,"stage":"unknown","request_type":"existing_ca"},{"bug":1978904,"ca":"NETLOCK's S/MIME & TLS Root","filed":"2025-07-23","days_waiting":420,"stage":"initial","request_type":"new_org"},{"bug":1983217,"ca":"Aretiico Group PLC and Aretiico Inc root certificates to Moz","filed":"2025-08-15","days_waiting":397,"stage":"initial","request_type":"existing_ca"},{"bug":1988341,"ca":"ACCV ROOT RSA TLS 2024 and ACCV ROOT ECC TLS 2024 root certi","filed":"2025-09-12","days_waiting":369,"stage":"verifying","request_type":"new_org"},{"bug":1988361,"ca":"SHECA Single-purpose Root CA Certificates","filed":"2025-09-12","days_waiting":369,"stage":"verifying","request_type":"new_org"},{"bug":1990213,"ca":"certSIGN Root CA G4 root certificate","filed":"2025-09-23","days_waiting":358,"stage":"verifying","request_type":"existing_ca"},{"bug":1992971,"ca":"Actalis TLS Root CAs 2025 and Actalis SMIME Root CAs 2025","filed":"2025-10-07","days_waiting":344,"stage":"verifying","request_type":"existing_ca"},{"bug":2001274,"ca":"Cybertrust Japan Root CA Cybertrust iTrust TLS ECCP384 Root ","filed":"2025-11-20","days_waiting":300,"stage":"initial","request_type":"existing_ca"},{"bug":2001275,"ca":"Cybertrust Japan Root CA Cybertrust iTrust TLS RSA4096 Root ","filed":"2025-11-20","days_waiting":300,"stage":"initial","request_type":"existing_ca"},{"bug":2007765,"ca":"Chunghwa Telecom CHT TrustRoot CA","filed":"2025-12-26","days_waiting":264,"stage":"initial","request_type":"existing_ca"},{"bug":2011714,"ca":"\"OATI webCARES Server Root CA\" to the Mozilla Root CA Progra","filed":"2026-01-21","days_waiting":238,"stage":"initial","request_type":"new_org"},{"bug":2031847,"ca":"FNMT TLS RSA Root Certificate SERVIDORES SEGUROS G2R","filed":"2026-04-14","days_waiting":155,"stage":"initial","request_type":"new_org"},{"bug":2033449,"ca":"A-Trust SMIME Root","filed":"2026-04-20","days_waiting":149,"stage":"initial","request_type":"existing_ca"},{"bug":2033676,"ca":"National Certification Authority of Sri Lanka TLS Root CA - ","filed":"2026-04-21","days_waiting":148,"stage":"initial","request_type":"new_org"},{"bug":2033815,"ca":"Disig new S/MIME & TLS Roots","filed":"2026-04-21","days_waiting":148,"stage":"initial","request_type":"new_org"},{"bug":2035858,"ca":"GoDaddy and Starfield TLS R1 Root Certificates","filed":"2026-04-29","days_waiting":140,"stage":"unknown","request_type":"existing_ca"},{"bug":2037054,"ca":"Certum TLS RSA Root CA and Certum TLS ECC Root CA","filed":"2026-05-05","days_waiting":134,"stage":"initial","request_type":"new_org"},{"bug":2046825,"ca":"KIR single-purpose TLS and SMIME Root CA's","filed":"2026-06-11","days_waiting":97,"stage":"initial","request_type":"new_org"},{"bug":2059382,"ca":"Microsec \"e-Szigno RSA TLS Root CA 2025\" and \"e-Szigno SMIME","filed":"2026-07-30","days_waiting":48,"stage":"initial","request_type":"existing_ca"}],"mozilla_completed_recent":[{"bug":1658793,"ca":"Cybertrust Japan SecureSign Roots (CA12, CA14 and CA15)","filed":"2020-08-12","resolved":"2025-01-24","days":1626,"request_type":"existing_ca"},{"bug":1845047,"ca":"SwissSign RSA TLS Root CA 2022 - 1 and SwissSign RSA SMIME R","filed":"2023-07-24","resolved":"2026-09-09","days":1143,"request_type":"existing_ca"},{"bug":1647181,"ca":"BJCA root certificate(s)","filed":"2020-06-22","resolved":"2023-05-11","days":1053,"request_type":"new_org"},{"bug":1688854,"ca":"TrustAsia root certificates","filed":"2021-01-26","resolved":"2023-11-30","days":1038,"request_type":"existing_ca"},{"bug":1627552,"ca":"e-commerce monitoring's GLOBALTRUST 2020 root certificate","filed":"2020-04-05","resolved":"2022-11-14","days":953,"request_type":"existing_ca"},{"bug":1628720,"ca":"E-Tugra Root Certificates RSA v3 / ECC v3","filed":"2020-04-09","resolved":"2022-11-14","days":949,"request_type":"new_org"},{"bug":1637269,"ca":"GlobalSign SMIME Roots to Mozilla root store","filed":"2020-05-12","resolved":"2022-11-14","days":916,"request_type":"existing_ca"},{"bug":1710831,"ca":"LAWtrust Root CA2 to NSS","filed":"2021-05-12","resolved":"2023-08-01","days":811,"request_type":"existing_ca"},{"bug":1664161,"ca":"Telia CA root certificate","filed":"2020-09-10","resolved":"2022-11-14","days":795,"request_type":"existing_ca"},{"bug":1873057,"ca":"Microsec \"e-Szigno TLS Root CA 2023\"","filed":"2024-01-04","resolved":"2026-02-18","days":776,"request_type":"existing_ca"},{"bug":1675821,"ca":"Re-Signed GTS Roots","filed":"2020-11-06","resolved":"2022-11-14","days":738,"request_type":"new_org"},{"bug":1918570,"ca":"SECOM SMIME RSA Root CA 2024","filed":"2024-09-13","resolved":"2026-07-15","days":670,"request_type":"existing_ca"},{"bug":1785215,"ca":"\"FIRMAPROFESIONAL CA ROOT-A WEB\" Root Certificate","filed":"2022-08-17","resolved":"2024-06-10","days":663,"request_type":"new_org"},{"bug":1694421,"ca":"DigitalSign's root certificates","filed":"2021-02-23","resolved":"2022-11-14","days":629,"request_type":"new_org"},{"bug":1836258,"ca":"D-TRUST BR Root CA 2 2023 and D-TRUST EV Root CA 2 2023","filed":"2023-06-01","resolved":"2025-02-18","days":628,"request_type":"existing_ca"},{"bug":1695487,"ca":"HARICA 2021 TLS Root CA Certificates to Mozilla Root store p","filed":"2021-02-28","resolved":"2022-11-14","days":624,"request_type":"existing_ca"},{"bug":1695486,"ca":"HARICA 2021 SMIME Root CA Certificates to Mozilla Root store","filed":"2021-02-28","resolved":"2022-11-14","days":624,"request_type":"existing_ca"},{"bug":1925173,"ca":"Cybertrust Japan SecureSign Root CA16","filed":"2024-10-17","resolved":"2026-06-15","days":606,"request_type":"existing_ca"},{"bug":1763177,"ca":"Commscope Root Certificates","filed":"2022-04-05","resolved":"2023-11-28","days":602,"request_type":"new_org"},{"bug":1706228,"ca":"DigiCert root Certificates","filed":"2021-04-20","resolved":"2022-11-14","days":573,"request_type":"existing_ca"},{"bug":1781510,"ca":"D-Trust SBR Root CAs 1 & 2 2022","filed":"2022-07-26","resolved":"2024-02-01","days":555,"request_type":"existing_ca"},{"bug":1943001,"ca":"SECOM TLS RSA Root CA 2024 and SECOM TLS ECC Root CA 2024","filed":"2025-01-22","resolved":"2026-07-15","days":539,"request_type":"existing_ca"},{"bug":1799533,"ca":"SSL.com 2022 TLS Root CA Certificates","filed":"2022-11-07","resolved":"2024-03-15","days":494,"request_type":"existing_ca"},{"bug":1720400,"ca":"Actalis intermediate certs to OneCRL","filed":"2021-07-13","resolved":"2022-11-14","days":489,"request_type":"existing_ca"},{"bug":1727941,"ca":"Certainly R1 and E1 Root Certificates","filed":"2021-08-27","resolved":"2022-11-14","days":444,"request_type":"existing_ca"},{"bug":1968852,"ca":"Telia Company's S/MIME & TLS Roots","filed":"2025-05-28","resolved":"2026-07-15","days":413,"request_type":"existing_ca"},{"bug":1849702,"ca":"Taiwan-CA Inc. (TWCA) root certificates","filed":"2023-08-22","resolved":"2024-09-13","days":388,"request_type":"existing_ca"},{"bug":1782092,"ca":"Atos Roots","filed":"2022-07-28","resolved":"2023-08-01","days":369,"request_type":"existing_ca"},{"bug":1820592,"ca":"Telekom Security Root Certificates","filed":"2023-03-06","resolved":"2024-02-16","days":347,"request_type":"existing_ca"},{"bug":1936279,"ca":"OISTE root certificates","filed":"2024-12-10","resolved":"2025-11-19","days":344,"request_type":"existing_ca"},{"bug":1929329,"ca":"TrustAsia Dedicated Roots","filed":"2024-11-05","resolved":"2025-09-27","days":326,"request_type":"existing_ca"},{"bug":1799703,"ca":"SSL.com 2022 Client Root CA Certificates","filed":"2022-11-08","resolved":"2023-08-01","days":266,"request_type":"existing_ca"},{"bug":1817340,"ca":"Sectigo R46/E46 Roots","filed":"2023-02-16","resolved":"2023-08-14","days":179,"request_type":"existing_ca"}],"mozilla_stats":{"pending_count":31,"completed_count":33,"median_days":624,"mean_days":654,"max_days":1626,"longest_pending_days":3467,"new_org":{"count":6,"median_days":700,"mean_days":772,"max_days":1053,"pending_count":15,"longest_pending_days":3093},"existing_ca":{"count":27,"median_days":573,"mean_days":627,"max_days":1626,"pending_count":16,"longest_pending_days":3467}},"note":"Mozilla only \u2014 only root program with a fully public inclusion pipeline (Bugzilla)."},"coverageRateByYear":[{"y":2014,"total_bugs":3,"chrome":33.3,"mozilla":33.3,"apple":0.0,"microsoft":0.0},{"y":2015,"total_bugs":1,"chrome":0.0,"mozilla":100.0,"apple":0.0,"microsoft":0.0},{"y":2016,"total_bugs":5,"chrome":20.0,"mozilla":80.0,"apple":0.0,"microsoft":0.0},{"y":2017,"total_bugs":123,"chrome":49.6,"mozilla":86.2,"apple":0.0,"microsoft":0.0},{"y":2018,"total_bugs":108,"chrome":16.7,"mozilla":82.4,"apple":0.0,"microsoft":0.0},{"y":2019,"total_bugs":255,"chrome":67.8,"mozilla":78.0,"apple":0.0,"microsoft":0.0},{"y":2020,"total_bugs":237,"chrome":66.2,"mozilla":49.4,"apple":0.0,"microsoft":0.0},{"y":2021,"total_bugs":187,"chrome":58.3,"mozilla":30.5,"apple":0.0,"microsoft":0.0},{"y":2022,"total_bugs":106,"chrome":22.6,"mozilla":28.3,"apple":0.0,"microsoft":0.0},{"y":2023,"total_bugs":133,"chrome":15.0,"mozilla":27.1,"apple":0.0,"microsoft":0.0},{"y":2024,"total_bugs":236,"chrome":22.5,"mozilla":32.2,"apple":5.9,"microsoft":0.0},{"y":2025,"total_bugs":223,"chrome":18.4,"mozilla":9.9,"apple":5.4,"microsoft":0.0},{"y":2026,"total_bugs":241,"chrome":8.7,"mozilla":4.6,"apple":5.8,"microsoft":0.0}]},"ecosystemParticipation":{"meta":{"generated_at":"2026-09-16T11:17:16.336733+00:00","pipeline_version":"1.1","total_orgs":62,"total_cabf_ca_members":56,"total_individuals":139,"total_ballots":174,"note_technical":"technical_comments counts LLM-classified substantive comments (cert/CRL analysis, specific BR citations, investigative questions). Values may exceed bugs_engaged since multiple technical comments per bug are counted.","note_baseline":"All CABF CA members included as org rows, even those with zero engagement. cabf_member=true indicates formal membership. Absence of engagement by a member is as meaningful as presence."},"cabfMemberCount":56,"activeMemberCount":21,"zeroContributionCount":35,"topOrganizations":[{"name":"Sectigo","cabfMember":true,"bugzillaEngaged":136,"ballotsProposed":9,"ballotsEndorsed":18,"bugsFiled":14},{"name":"DigiCert","cabfMember":true,"bugzillaEngaged":31,"ballotsProposed":60,"ballotsEndorsed":38,"bugsFiled":0},{"name":"HARICA","cabfMember":true,"bugzillaEngaged":54,"ballotsProposed":16,"ballotsEndorsed":29,"bugsFiled":0},{"name":"Let's Encrypt","cabfMember":true,"bugzillaEngaged":61,"ballotsProposed":2,"ballotsEndorsed":2,"bugsFiled":1},{"name":"iSigma","cabfMember":false,"bugzillaEngaged":17,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":7},{"name":"Entrust","cabfMember":true,"bugzillaEngaged":0,"ballotsProposed":9,"ballotsEndorsed":20,"bugsFiled":0},{"name":"Certainly/Fastly","cabfMember":true,"bugzillaEngaged":5,"ballotsProposed":5,"ballotsEndorsed":6,"bugsFiled":0},{"name":"GlobalSign","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":5,"ballotsEndorsed":11,"bugsFiled":0},{"name":"TrustCor Systems","cabfMember":false,"bugzillaEngaged":0,"ballotsProposed":5,"ballotsEndorsed":8,"bugsFiled":0},{"name":"SwissSign","cabfMember":true,"bugzillaEngaged":6,"ballotsProposed":0,"ballotsEndorsed":4,"bugsFiled":0},{"name":"SSL.com","cabfMember":true,"bugzillaEngaged":4,"ballotsProposed":1,"ballotsEndorsed":3,"bugsFiled":0},{"name":"Amazon Trust Services","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":2,"ballotsEndorsed":5,"bugsFiled":0},{"name":"Chunghwa Telecom","cabfMember":true,"bugzillaEngaged":3,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":1},{"name":"Cisco","cabfMember":false,"bugzillaEngaged":0,"ballotsProposed":2,"ballotsEndorsed":1,"bugsFiled":0},{"name":"Certum/Asseco","cabfMember":true,"bugzillaEngaged":0,"ballotsProposed":1,"ballotsEndorsed":0,"bugsFiled":0},{"name":"GoDaddy","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":1,"bugsFiled":0},{"name":"Telia","cabfMember":true,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":1,"bugsFiled":0},{"name":"Certinomis","cabfMember":false,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":0},{"name":"PKIoverheid","cabfMember":false,"bugzillaEngaged":1,"ballotsProposed":0,"ballotsEndorsed":0,"bugsFiled":0}],"topBallotIndividuals":[{"name":"Stephen Davidson","proposed":36,"endorsed":1},{"name":"Dimitris Zacharopoulos","proposed":15,"endorsed":28},{"name":"Tim Hollebeek","proposed":9,"endorsed":20},{"name":"Bruce Morton","proposed":6,"endorsed":20},{"name":"Martijn Katerbarg","proposed":8,"endorsed":13},{"name":"Corey Bonnell","proposed":8,"endorsed":10},{"name":"Doug Beattie","proposed":5,"endorsed":6},{"name":"Ben Wilson","proposed":4,"endorsed":2},{"name":"Dean Coclin","proposed":3,"endorsed":3},{"name":"Neil Dunbar","proposed":2,"endorsed":6},{"name":"Daniel Jeffery","proposed":3,"endorsed":2},{"name":"Dunbar","proposed":3,"endorsed":2},{"name":"Wayne Thayer","proposed":2,"endorsed":4},{"name":"Aaron Gable","proposed":2,"endorsed":2},{"name":"Ben Slaughter","proposed":2,"endorsed":1}],"individualCount":139},"regulatorySurface":{"currentYear":2026,"totalObligations":6657,"mandatory":5056,"recommended":631,"optional":970,"mandatoryPct":76,"baselineYear":2000,"baselineTotal":55,"growthMultiple":121,"sourceTotals":{"cabfForum":2785,"rootPrograms":537,"auditIetf":1972,"regulatory":761},"tlsBr":{"v1_0_total":278,"current_total":1268,"operational":566,"profileSpec":702},"ballots":{"total":0,"since2022":0,"byDoc":{}},"timeSeries":[{"y":2000,"t":55,"m":40},{"y":2001,"t":55,"m":40},{"y":2002,"t":55,"m":40},{"y":2003,"t":55,"m":40},{"y":2004,"t":286,"m":218},{"y":2005,"t":286,"m":218},{"y":2006,"t":286,"m":218},{"y":2007,"t":286,"m":218},{"y":2008,"t":883,"m":576},{"y":2009,"t":883,"m":576},{"y":2010,"t":883,"m":576},{"y":2011,"t":883,"m":576},{"y":2012,"t":1216,"m":838},{"y":2013,"t":1249,"m":856},{"y":2014,"t":1249,"m":856},{"y":2015,"t":1552,"m":1084},{"y":2016,"t":1594,"m":1114},{"y":2017,"t":1655,"m":1167},{"y":2018,"t":1850,"m":1306},{"y":2019,"t":2257,"m":1563},{"y":2020,"t":2627,"m":1933},{"y":2021,"t":3821,"m":2832},{"y":2022,"t":3980,"m":2942},{"y":2023,"t":4533,"m":3401},{"y":2024,"t":6562,"m":4981},{"y":2025,"t":6698,"m":5086},{"y":2026,"t":6657,"m":5056}],"methodology":""},"tabIntros":{"generatedAt":"2026-09-16T11:41:59.891794+00:00","model":"claude-sonnet-4-5","note":"Analyst summaries generated by Claude from the prior day's snapshot. Each paragraph states the key finding for that tab with specific numbers and connects to related tabs.","intros":{"market":"Five certificate authorities control 91% of all publicly trusted issuance, with Let's Encrypt (ISRG) leading at 37.1% and Google Trust Services at 21.1%. The market HHI of 2254 indicates moderate concentration, with 75 CAs in the long tail serving the remaining 8.5% of the ecosystem. DigiCert, GoDaddy, and Sectigo round out the top five, collectively representing the operational backbone of the public web's cryptographic identity layer.","trust":"335 trusted roots are distributed across four major browser and operating system trust stores, but only 90 roots appear in all four programs simultaneously. Microsoft maintains 142 roots not trusted by Chrome, Mozilla, or Apple, creating significant store disagreement that forces CAs to maintain multiple certificate chains and complicates validation logic for relying parties. Just 38 CA owners hold roots in all four stores, concentrating effective universal trust in a small operator cohort despite the appearance of a larger diverse ecosystem.","conc":"The CR3 ratio of 74.5% means three organizations control nearly three-quarters of all certificate issuance, creating systemic dependency on ISRG, Google, and DigiCert infrastructure. An HHI of 2254 sits above the DOJ threshold for moderately concentrated markets, while the 89 trusted CAs mask the reality that the top five account for over 91% of volume. A sustained outage or compromise at any top-three provider would immediately affect hundreds of millions of domains, yet no formal continuity mechanism exists to absorb such failure.","tail":"75 certificate authorities operate in the long tail with full trust store inclusion but collectively issue fewer than 9% of all certificates. These CAs range from regional providers to specialized enterprise authorities, each maintaining the operational overhead of audit compliance, incident response, and root program engagement despite minimal market presence. The tail represents latent systemic risk, as low issuance volume correlates with reduced operational investment and historically higher incident rates per certificate issued.","geo":"United States-incorporated CAs issue 92.3% of all publicly trusted certificates, despite 44 European CAs and 17 Asia-Pacific authorities holding trust store positions. Europe accounts for just 7.6% of issuance volume and Asia-Pacific rounds to 0.09%, revealing a profound geographic concentration that mirrors but intensifies the market share findings. The dominance of US-based issuers creates jurisdictional exposure analyzed separately in the legal risk framework, but the incorporation pattern itself reflects where technical capability, capital, and audit infrastructure have historically concentrated.","gov":"30 government-operated or state-owned certificate authorities hold trusted roots across the four major programs, though they collectively represent only 0.08% of observed issuance volume. These CAs span national PKI programs, military certificate services, and sovereign identity initiatives, maintaining trusted status primarily for domestic or specialized use cases rather than public web issuance. The presence of state-controlled CAs in global trust stores creates ongoing policy tension between technical interoperability requirements and geopolitical trust boundaries, particularly for governments identified in the high-risk jurisdiction framework.","jurisdiction":"Five jurisdictions are classified as high legal risk due to compelled disclosure laws, encryption restrictions, or state surveillance frameworks: China, Russia, United Kingdom, Australia, and Hong Kong. India and Turkey are rated moderate risk based on evolving data localization and intermediation requirements that could force CAs to compromise certificate integrity or subscriber privacy. These legal frameworks intersect with the geographic concentration finding that 92% of issuance originates from US-incorporated CAs, creating a single-point jurisdictional dependency for the global web.","ops":"1,572 compliance incidents have been recorded across 54 certificate authorities, led by misissuance (611 incidents), governance failures (505), and revocation problems (332). CAs self-detect only 26% of their own incidents, while external researchers, automated tools, and root programs collectively account for most discovery, indicating systemic surveillance and control gaps. Policy failures (195) and disclosure failures (139) outnumber audit findings (108), suggesting that third-party audits examined in the audit intelligence analysis miss or do not surface the operational lapses that ultimately appear in public incident reports.","crypto":"The cryptographic posture data examines root certificate algorithms, key sizes, signature methods, and compliance with contemporary standards across the 335 trusted roots. Migration from SHA-1 to SHA-256, adoption of 4096-bit RSA keys, and preparation for post-quantum cryptography create a slowly evolving technical foundation beneath the operational and governance risks measured elsewhere. Algorithm choices made by root CAs cascade through billions of subscriber certificates, making cryptographic decisions at the trust anchor level among the longest-lived and highest-impact architectural choices in the ecosystem.","distrust":"16 distrust events have occurred across browser and operating system programs, with 14 attributed to compliance or operational failures rather than cryptographic compromise. Seven CAs exhibited negligent noncompliance posture, three demonstrated willful circumvention, and three showed demonstrated incompetence, revealing the behavioral patterns that lead root programs to remove trust. The median runway from distrust announcement to effective removal is 1,185 days, providing extended notice periods that balance ecosystem stability against the urgency of removing problematic actors identified through the 1,572 incidents in the operational risk data.","policy":"43 active TLS-issuing CAs face declining maximum validity limits under SC-081: 200 days by March 2026, 100 days by March 2027, and 47 days by March 2029, with current median certificate use at 70 days leaving 5 CAs at risk in the first phase and 8 already operating at 47-day readiness. Compliance complexity has grown 121-fold since 2000 to 6,657 total obligations spanning CA/B Forum baseline requirements, four root program policies, WebTrust and ETSI audit criteria, and IETF/NIST standards, with 76% now mandatory rather than recommended. Operational readiness for shorter validity periods is challenged by the expanding regulatory surface that demands increasing CA investment in monitoring, implementation, and documentation even as automation pressures intensify.","governance":"Chrome participated in 18.4% of the 223 incident discussions in 2025, down from 67.8% in 2019, while Mozilla declined from 78.0% to 9.9% and Apple contributed to just 5.4% of cases. Microsoft provided zero oversight participation in 2025 despite operating a trust store, leaving the majority of the 1,572 recorded incidents without formal root program engagement in their public disclosure threads. The declining coverage rate means CAs increasingly self-manage incident response without the forcing function of root program scrutiny, directly correlating with the operational finding that only 26% of incidents are self-detected.","community":"56 organizations hold CA/B Forum membership but only 21 contribute actively to ballot or discussion processes, leaving 35 members with zero recorded participation in policy development. Stephen Davidson of Sectigo leads individual ballot activity with 36 proposals, while Sectigo as an organization tops contribution metrics despite ranking fifth in market share at 7.3%. The participation gap means governance decisions affecting the entire 6,657-obligation compliance surface are shaped by a small subset of stakeholders, many operating in the long tail rather than the concentrated top five that serve 91% of issuance volume.","audit":"Auditors caught 35% of the incidents that occurred during the period covered by their audit letters, meaning 65% of real operational problems coexisted with unqualified opinions issued to the same CAs. 39 CAs show high transparency gaps between clean audit reports and substantial Bugzilla incident histories, while only 4 qualified opinions appear across 80 parsed letters despite the 1,572 total incidents recorded in the operational data. WebTrust self-reporting sits at 59% and ETSI at 67%, with 11 auditor changes in 2025 and 9 CAs still operating under deprecated ETSI standards, revealing that audit letters provide incomplete surveillance of the operational and governance risks measured elsewhere in this system."}},"auditIntelligence":{"generatedAt":"2026-09-16T11:12:35.826305Z","summary":{"totalCAOwners":83,"parsedLetters":80,"highTransparencyGap":39,"qualifiedOpinions":4,"mattersWithoutBzAnchor":11,"auditorHHI":541.4,"auditRecordStatus":{"named":83,"extractable":0,"lapsed":0,"no_record":0},"stalenessDistribution":{"aging":32,"current":25,"stale":20,"very_stale":6}},"frameworkStats":{"WebTrust":49,"ETSI":34},"selfReportByFramework":{"webTrust":59.1,"etsi":66.5},"inPeriodDetection":{"covered":414,"caught":145,"multiCycleMisses":46,"detectionPct":35.0,"note":"Denominator = unique bugs with at least one covering audit period. Caught = mentioned in any covering letter."},"perAuditorDetection":[{"auditor":"MATRIX Ltd.","caught":11,"total":11,"detectionPct":100.0},{"auditor":"T\u00dcV NORD","caught":3,"total":3,"detectionPct":100.0},{"auditor":"TayllorCox PCEB","caught":3,"total":3,"detectionPct":100.0},{"auditor":"PwC","caught":12,"total":13,"detectionPct":92.3},{"auditor":"Anthony Kam & Associates Ltd.","caught":6,"total":7,"detectionPct":85.7},{"auditor":"SunRise CPAs / DFK","caught":5,"total":10,"detectionPct":50.0},{"auditor":"LSTI","caught":7,"total":15,"detectionPct":46.7},{"auditor":"Ernst & Young","caught":27,"total":66,"detectionPct":40.9},{"auditor":"T\u00dcV Austria","caught":7,"total":18,"detectionPct":38.9},{"auditor":"DEKRA","caught":5,"total":13,"detectionPct":38.5},{"auditor":"AENOR","caught":3,"total":8,"detectionPct":37.5},{"auditor":"Deloitte","caught":7,"total":20,"detectionPct":35.0},{"auditor":"BDO International","caught":42,"total":152,"detectionPct":27.6},{"auditor":"T\u00dcViT","caught":2,"total":8,"detectionPct":25.0},{"auditor":"datenschutz cert GmbH","caught":1,"total":4,"detectionPct":25.0},{"auditor":"Schellman","caught":2,"total":15,"detectionPct":13.3},{"auditor":"KPMG","caught":2,"total":48,"detectionPct":4.2},{"auditor":"Certop Informatikai Tan\u00fas\u00edt\u00e1si Szolg\u00e1ltat\u00e1sok Kft.","caught":0,"total":6,"detectionPct":0.0},{"auditor":"Scott S. Perry CPA, PLLC","caught":0,"total":32,"detectionPct":0.0},{"auditor":"Crowe FST Audit Ltd","caught":0,"total":6,"detectionPct":0.0},{"auditor":"QMSCERT","caught":0,"total":4,"detectionPct":0.0},{"auditor":"QSCert","caught":0,"total":8,"detectionPct":0.0}],"alvEquivalentFindings":{"parsedLetters":80,"missingRootFingerprints":0,"certificateScopeGaps":8,"accurateFingerprintCoverage":0,"untracedRoots":5,"missingFingerprintsPct":0,"scopeGapsPct":10},"perAuditorAlvFindings":[{"auditor":"LSTI","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Ernst & Young","clients":5,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"TayllorCox PCEB","clients":5,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Deloitte","clients":7,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"AENOR","clients":3,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"CSQA Certificazioni","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Schellman","clients":3,"missingFingerprintsPct":0,"scopeGapPct":33},{"auditor":"BDO International","clients":7,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"QMSCERT","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"SunRise CPAs / DFK","clients":5,"missingFingerprintsPct":0,"scopeGapPct":40},{"auditor":"KPMG","clients":10,"missingFingerprintsPct":0,"scopeGapPct":10},{"auditor":"T\u00dcV NORD","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"datenschutz cert GmbH","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"A-SIT","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"DEKRA","clients":2,"missingFingerprintsPct":0,"scopeGapPct":0},{"auditor":"Auren","clients":2,"missingFingerprintsPct":0,"scopeGapPct":50}],"qualifiedOpinions":[{"ca":"Entrust","stores":["apple","microsoft"],"auditor":"Deloitte"},{"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","stores":["microsoft"],"auditor":"QMSCERT"},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","stores":["microsoft"],"auditor":"KPMG"},{"ca":"e-commerce monitoring GmbH","stores":["microsoft"],"auditor":"A-SIT"}],"highTransparencyGapCAs":[{"ca":"DigiCert","incidentCount":181,"gapScore":98.3,"mattersCount":3,"auditor":"BDO International","framework":"WebTrust"},{"ca":"Sectigo","incidentCount":117,"gapScore":97.4,"mattersCount":3,"auditor":"BDO International","framework":"WebTrust"},{"ca":"IdenTrust Services, LLC","incidentCount":79,"gapScore":96.2,"mattersCount":4,"auditor":"BDO International","framework":"WebTrust"},{"ca":"SwissSign AG","incidentCount":68,"gapScore":94.1,"mattersCount":4,"auditor":"T\u00dcV Austria","framework":"ETSI"},{"ca":"GlobalSign nv-sa","incidentCount":59,"gapScore":98.3,"mattersCount":1,"auditor":"KPMG","framework":"WebTrust"},{"ca":"Asseco Data Systems S.A.","incidentCount":53,"gapScore":96.2,"mattersCount":2,"auditor":"Ernst & Young","framework":"WebTrust"},{"ca":"Microsoft Corporation","incidentCount":53,"gapScore":86.8,"mattersCount":7,"auditor":"Deloitte","framework":"WebTrust"},{"ca":"GoDaddy","incidentCount":48,"gapScore":100.0,"mattersCount":0,"auditor":"Schellman","framework":"WebTrust"},{"ca":"Autoridad de Certificacion Firmaprofesional","incidentCount":44,"gapScore":86.4,"mattersCount":6,"auditor":"DEKRA","framework":"ETSI"},{"ca":"Netlock","incidentCount":42,"gapScore":83.3,"mattersCount":7,"auditor":"MATRIX Ltd.","framework":"ETSI"}],"etsiAalAdoption":{"2":1,"unknown":3,"3.1":1,"3.4":16,"3.5":9,"2.9":1,"3.0":1},"auditorChanges":[{"year":2024,"ca":"Department of Defence Australia","from":"Deloitte","to":"Ionize"},{"year":2025,"ca":"EDICOM","from":"Audit Trust","to":"AENOR"},{"year":2025,"ca":"IdenTrust Services, LLC","from":"Schellman","to":"BDO International"},{"year":2025,"ca":"Government of Finland, Population Register Centre\u2019s (V\u00e4est\u00f6rekisterikeskus, VRK)","from":"datenschutz cert GmbH","to":"QMSCERT"},{"year":2024,"ca":"Netlock","from":"Certop Informatikai Tan\u00fas\u00edt\u00e1si Szolg\u00e1ltat\u00e1sok Kft.","to":"MATRIX Ltd."},{"year":2024,"ca":"China Financial Certification Authority (CFCA)","from":"PwC","to":"Anthony Kam & Associates Ltd."},{"year":2025,"ca":"TrustAsia Technologies, Inc.","from":"Anthony Kam & Associates Ltd.","to":"SunRise CPAs / DFK"},{"year":2025,"ca":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","from":"Ernst & Young","to":"Moreira Associados Auditores Independentes"},{"year":2025,"ca":"Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)","from":"ICTA/BTK - Turkish Information and Communication Technologies Authority","to":"KIWA CERMET Italia S.p.A"},{"year":2025,"ca":"Agence Nationale de Certification Electronique","from":"LSTI","to":"Deloitte"},{"year":2025,"ca":"Chunghwa Telecom","from":"SunRise CPAs / DFK","to":"KPMG"},{"year":2025,"ca":"Chunghwa Telecom","from":"KPMG","to":"SunRise CPAs / DFK"},{"year":2025,"ca":"Izenpe S.A.","from":"LSTI","to":"AENOR"},{"year":2026,"ca":"Buypass","from":"BSI","to":"Attestic B.V."},{"year":2025,"ca":"Telia Company","from":"KPMG","to":"datenschutz cert GmbH"},{"year":2026,"ca":"A-Trust","from":"Ernst & Young","to":"A-SIT"},{"year":2026,"ca":"Government of Hong Kong (SAR), Hongkong Post, Certizen","from":"PwC","to":"RSM Hong Kong"},{"year":2026,"ca":"certSIGN","from":"Crowe FST Audit Ltd","to":"LSTI"},{"year":2026,"ca":"Autoridad de Certificaci\u00f3n (ANF AC)","from":"CSQA Certificazioni","to":"DEKRA"},{"year":2026,"ca":"Actalis","from":"IMQ S.p.A.","to":"TayllorCox PCEB"},{"year":2026,"ca":"ComSign","from":"Sharony - Shefler & Co. CPA","to":"BDO Israel"},{"year":2026,"ca":"Microsoft Corporation","from":"BDO International","to":"Deloitte"},{"year":2026,"ca":"Government of Japan, Digital Agency","from":"Ernst & Young","to":"KPMG"},{"year":2026,"ca":"Halcom D.D.","from":"SLOVENIAN ACCREDITATION","to":"Bureau Veritas d.o.o."},{"year":2026,"ca":"GoDaddy","from":"KPMG","to":"Schellman"}],"mattersWithoutBzAnchor":[{"ca":"Carillon Information Security Inc.","summary":"On March 16, 2024, Carillon migrated to a new CIS infrastructure, which included"},{"ca":"DigitalSign - Certificadora Digital, S.A.","summary":"One minor non-conformity identified regarding lack of documentation of the vulne"},{"ca":"IdenTrust Services, LLC","summary":"For two (2) out of two (2) quarters selected for testing, IdenTrust did not sele"},{"ca":"Saudi Data and Artificial Intelligence Authority (SDAIA)","summary":"During the examination period there were no instances of key generation, key arc"},{"ca":"Google Trust Services LLC","summary":"GTS failed to record certificate lifecycle events in the audit log during onboar"},{"ca":"Izenpe S.A.","summary":"Not allowed Key Usage found in OCSP responder certificate."},{"ca":"Buypass","summary":"Documentation and implementation of compliance auditing on support processes sha"},{"ca":"Buypass","summary":"Documentation and implementation of Supply Chain Policy shall be improved."},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"Not all information required is documented in the Terms and Conditions."},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The process for the appointment of trusted roles is not formalized and does not "},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The asset management documentation has not been finalized and formally approved "},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The racks are in a server room of the FOITT and shared with other departments; t"},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"Not all names in certificates were correctly registered as part of the Period of"},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The network is provided as a service by FOITT and is not managed by the SG PKI d"},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The Log Data Management Concept should be checked and updated if necessary."},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"No fire extinguishers were found in close proximity to the server racks."},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"There is no description on how cryptographic devices should be stored."},{"ca":"Swiss BIT, Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT)","summary":"The process for destroying cryptographic keys and devices is only available as a"},{"ca":"A-Trust","summary":"No assertion to a mass revocation plan in section 5.7.1 of CP/CPS version 2.6, f"},{"ca":"Macao Post and Telecommunications Bureau","summary":"All certificates issued by eSignTrust contain an 'Organisation' attribute of 'Ma"},{"ca":"Government of Sweden (F\u00f6rs\u00e4kringskassan)","summary":"SSIA disclosed that ballot SC47v2 prohibiting the issuance of new certificates w"}],"topAuditors":[{"name":"KPMG","caCount":11,"country":"Global (US/UK)","avgQualityScore":76.4,"avgGapScore":99.6,"highGapCount":4,"avgMattersPerCA":1.1},{"name":"Deloitte","caCount":7,"country":"Global (US/UK)","avgQualityScore":71.8,"avgGapScore":73.4,"highGapCount":1,"avgMattersPerCA":2.0},{"name":"BDO International","caCount":7,"country":"Global (US/UK)","avgQualityScore":55.9,"avgGapScore":93.8,"highGapCount":7,"avgMattersPerCA":2.7},{"name":"TayllorCox PCEB","caCount":5,"country":"Czech Republic","avgQualityScore":84.6,"avgGapScore":94.5,"highGapCount":2,"avgMattersPerCA":0.6},{"name":"Ernst & Young","caCount":5,"country":"Global (US/UK)","avgQualityScore":77.6,"avgGapScore":92.9,"highGapCount":3,"avgMattersPerCA":1.6},{"name":"SunRise CPAs / DFK","caCount":5,"country":"United States","avgQualityScore":54.5,"avgGapScore":94.3,"highGapCount":3,"avgMattersPerCA":1.2},{"name":"DEKRA","caCount":3,"country":"Spain","avgQualityScore":82.5,"avgGapScore":93.2,"highGapCount":2,"avgMattersPerCA":3.0},{"name":"Schellman","caCount":3,"country":"United States","avgQualityScore":55.4,"avgGapScore":91.7,"highGapCount":2,"avgMattersPerCA":0.7},{"name":"LSTI","caCount":3,"country":"France","avgQualityScore":87.1,"avgGapScore":80.0,"highGapCount":1,"avgMattersPerCA":3.0},{"name":"AENOR","caCount":3,"country":"Spain","avgQualityScore":81.8,"avgGapScore":79.8,"highGapCount":1,"avgMattersPerCA":3.3},{"name":"A-SIT","caCount":2,"country":"Austria","avgQualityScore":100.0,"avgGapScore":null,"highGapCount":0,"avgMattersPerCA":1.0},{"name":"CSQA Certificazioni","caCount":2,"country":"Italy","avgQualityScore":80.8,"avgGapScore":null,"highGapCount":0,"avgMattersPerCA":0.5}]},"crlInfrastructureHealth":{"generatedAt":"2026-09-16T11:17:16Z","totalUrls":20474,"okCount":20215,"issueCount":259,"casTotal":82,"casWithIssues":26,"healthPct":98.7,"statusBreakdown":{"https_cert_expired":21,"ok":20215,"http_403":2,"issuer_mismatch":6,"url_inferred":1,"stale":14,"dns_error":1,"br_violation":4,"tls_hostname_mismatch":3,"connection_error":195,"http_404":3,"parse_failed":3,"timeout":2,"http_405":4},"totalRevoked":16661482,"revocationsPerDay":67.63,"globalRevocationPpm":19695.583,"revocationReasons":{"unspecified":7613793,"cessationOfOperation":4217795,"superseded":3774197,"privilegeWithdrawn":603823,"keyCompromise":330433,"affiliationChanged":97758,"certificateHold":23647,"cACompromise":31,"removeFromCRL":4,"aACompromise":1},"issuesByStore":{"microsoftOnly":50,"apple":207,"mozilla":209,"chrome":202},"casWithIssuesList":[{"ca":"A-Trust","status":"https_cert_expired","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Actalis","status":"https_cert_expired","in_apple":true,"in_chrome":false,"in_mozilla":true,"in_microsoft":true},{"ca":"Autoridad de Certificacion Firmaprofesional","status":"http_403","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"ComSign","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Consejo General de la Abogac\u00eda Espa\u00f1ola","status":"url_inferred","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"e-commerce monitoring GmbH","status":"stale","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Entrust","status":"stale","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"GlobalSign nv-sa","status":"br_violation","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"GoDaddy","status":"tls_hostname_mismatch","in_apple":true,"in_chrome":false,"in_mozilla":true,"in_microsoft":true},{"ca":"Google Trust Services LLC","status":"connection_error","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"Government of Brazil, Instituto Nacional de Tecnologia da Informa\u00e7\u00e3o (ITI)","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Government of India, Ministry of Communications & Information Technology, Controller of Certifying Authorities (CCA)","status":"http_404","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Government of Japan, Digital Agency","status":"connection_error","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Government of Korea, KLID","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Microsoft Corporation","status":"connection_error","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"Netlock","status":"br_violation","in_apple":false,"in_chrome":false,"in_mozilla":true,"in_microsoft":true},{"ca":"Notarius","status":"tls_hostname_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Open Access Technology International, Inc. (OATI)","status":"issuer_mismatch","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Prvn\u00ed certifika\u010dn\u00ed autorita, a.s.","status":"https_cert_expired","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Saudi Data and Artificial Intelligence Authority (SDAIA)","status":"http_404","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Sectigo","status":"timeout","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"Shanghai Electronic Certification Authority Co., Ltd.","status":"http_405","in_apple":true,"in_chrome":true,"in_mozilla":true,"in_microsoft":true},{"ca":"SI-TRUST","status":"https_cert_expired","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"SwissSign AG","status":"timeout","in_apple":true,"in_chrome":false,"in_mozilla":true,"in_microsoft":true},{"ca":"Thailand National Root Certificate Authority (Electronic Transactions Development Agency)","status":"http_403","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true},{"ca":"Zetes","status":"parse_failed","in_apple":false,"in_chrome":false,"in_mozilla":false,"in_microsoft":true}],"note":"CRL URLs are filed in CCADB by CA operators. issuer_mismatch means the wrong CRL URL is filed \u2014 CRLite/CRL Sets aggregators may miss revocations from that CA though CDP-fetching browsers are unaffected. br_violation means CRL validity window exceeds BR \u00a74.9.7 limits. Microsoft-only CAs are often government PKIs not governed by CA/B Forum BRs."}}