1# ------------------------------------------------------------------------------
2# Extended Validation CA Policy OIDs
3# Last updated: 22 Aug 2014, KCM
4#
5# Each uncommented non-empty line contains a mapping from a CA-defined EV OID
6# to the certificate file(s) in ./roots which are authoritative for that OID.
7# These lines are processed by the buildEVRoots script to generate the plist.
8#
9
10# Actalis
11# source: <rdar://problem/15836617>, <snrx://602642711>
12# confirmed by http://portal.actalis.it/cms/translations/en/actalis/Info/Solutions/Documents/ActalisCA_Audit_Statement.pdf
13#
14# (1.3.159.1.17.1) = 06062B811F011101
15#
16# roots: Actalis Authentication Root CA.cer
17#
181.3.159.1.17.1 "Actalis Authentication Root CA.cer"
19
20
21# AffirmTrust
22# source: <rdar://problem/7824821>
23# confirmed by http://www.affirmtrust.com/images/AffirmTrust_CPS_v1.1_12-23-2010.pdf
24#
25# (1.3.6.1.4.1.34697.2.1) = 
26#
27# roots: AffirmTrust-Commercial.der, AffirmTrust-Networking.der, AffirmTrust-Premium.der, AffirmTrust-Premium-ECC.der
28#
291.3.6.1.4.1.34697.2.1 "AffirmTrust-Commercial.der"
301.3.6.1.4.1.34697.2.2 "AffirmTrust-Networking.der"
311.3.6.1.4.1.34697.2.3 "AffirmTrust-Premium.der"
321.3.6.1.4.1.34697.2.4 "AffirmTrust-Premium-ECC.der"
33
34
35# Buypass (Norway)
36# TestURL: https://valid.evident.ca23.ssl.buypass.no/
37# TestURL: https://valid.evident.ca13.ssl.buypass.no
38# source: <sonr://Request/66633590>
39# confirmed by https://cert.webtrust.org/ViewSeal?id=848
40# confirmed by http://www.buypass.no/Bedrift/Produkter+og+tjenester/SSL/SSL%20dokumentasjon
41#
42# (2.16.578.1.26.1.3.3) = 0608608442011A010303
43#
44# root: Buypass Class 3 CA 1 Buypass AS-983163327
45#
46# confirmed by email with John Arild Amdahl Johansen on Nov.12 2013
47#
482.16.578.1.26.1.3.3 "Buypass Class 3 Root CA.cer" "BuypassClass3CA1.cer"
49
50
51# Certigna
52# TestURL: http://www.certigna.fr/ca/ACcertigna.crt
53# confirmed by <sonr://138828330>
54# 86F27C4BE875508EE8793C4BFC61791530729830
55# source <sonr://Request/138828330>
56# 
57# (1.2.250.1.177.1.18.2.2)
58# 
59# root: Certigna.cer
60#
611.2.250.1.177.1.18.2.2 "Certigna.cer"
62
63
64# Certum (Unizeto) (Poland)
65# source: <sonr://request/95347392>
66# source: <rdar://problem/7656178>, <rdar://problem/16974747>
67#
68# ( 1 2 616 1 113527 2 5 1 1 ) = 060B2A84680186F67702050101
69#
70# root: Certum Trusted Network CA
71# root: Certum CA
72#
731.2.616.1.113527.2.5.1.1 "Unizeto-CertumCA.cer" "Poland-Certum-CTNCA.der" "Certum Trusted Network CA 2.cer"
74
75
76# China Internet Network Information Center (CNNIC) (China)
77# source: <rdar://problem/9279621>
78#
79# ( 1 3 6 1 4 1 29836 1 10 ) =
80#
81# root: China Internet Network Information Center EV Certificates Root
82#
831.3.6.1.4.1.29836.1.10 "CNNICEVRoot.der"
84
85
86# Comodo
87# source: <http://www.mozilla.org/projects/security/certs/included/>
88# confirmed by <http://www.comodo.com/repository/EV_CPS_120806.pdf>
89#
90# (1.3.6.1.4.1.6449.1.2.1.5.1) = 060C2B06010401B2310102010501
91#
92# root: COMODO Certification Authority
93# subordinate CA of: Add Trust External CA Root
94#
951.3.6.1.4.1.6449.1.2.1.5.1 "COMODOCertificationAuthority.crt" "AddTrust External CA Root.crt"
96
97
98# Cybertrust (aka Verizon Business)
99# source: <http://en.wikipedia.org/wiki/Extended_Validation_Certificate>
100# confirmed by <http://cybertrust.omniroot.com/repository.cfm>
101#
102# (1.3.6.1.4.1.6334.1.100.1) = 060A2B06010401B13E016401
103#
104# root: GTE Cybertrust Global Root (removed: <rdar://17530554>)
105# root: Baltimore Cybertrust Root
106#
1071.3.6.1.4.1.6334.1.100.1 "BTCTRT.cer"
108
109
110# DigiCert
111# source: <http://www.mozilla.org/projects/security/certs/included/>
112# confirmed by <https://www.digicert.com/>
113# confirmed by <http://www.digicert.com/CPS_V3-0-3_3-15-2007.pdf>
114#
115# (2.16.840.1.114412.2.1) = 06096086480186FD6C0201  // EV CA-1
116# (2.16.840.1.114412.1.3.0.2) = 060B6086480186FD6C01030002  // EV CA-2
117#
118# root: DigiCert High Assurance EV Root CA
119# previously a subordinate CA of: Entrust.net Secure Server Certification Authority
120#
1212.16.840.1.114412.1.3.0.2 "DigiCertHighAssuranceEVRootCA.crt"
122
123# A14B48D943EE0A0E40904F3CE0A4C09193515D3F
124# F517A24F9A48C6C9F8A200269FDC0F482CAB3089
125# DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
126# 7E04DE896A3E666D00E687D33FFAD93BE83D349E
127# DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
128# TestURL: https://assured-id-root-g2.digicert.com
129# TestURL: https://assured-id-root-g3.digicert.com
130# TestURL: https://global-root-g2.digicert.com
131# TestURL: https://global-root-g3.digicert.com
132# TestURL: https://trusted-root-g4.digicert.com
133# confirmed by <snrx://600058205>
1342.16.840.1.114412.2.1 "DigiCertHighAssuranceEVRootCA.crt" "DigiCertAssuredIDRootG2.der" "DigiCertAssuredIDRootG3.der" "DigiCertGlobalRootG2.der" "DigiCertGlobalRootG3.der" "DigiCertTrustedRootG4.der"
135
136
137# DigiNotar
138# source: <http://www.mozilla.org/projects/security/certs/included/>
139# confirmed by <https://www.diginotar.com/>
140#
141# (2.16.528.1.1001.1.1.1.12.6.1.1.1) = 060E6084100187690101010C06010101
142#
143# root: DigiNotar Root CA
144#
145# removed per <rdar://problem/10040471>
146# 2.16.528.1.1001.1.1.1.12.6.1.1.1 "DigiNotarRootCA2007.crt" 
147
148
149# D-Trust
150# <rdar://problem/13718023> open .D-Trust root certificates
151#
152# 1.3.6.1.4.1.4788.2.202.1
153#
154# root: D-TRUST_Root_Class_3_CA_2_EV_2009.cer
155#
1561.3.6.1.4.1.4788.2.202.1 "D-TRUST_Root_Class_3_CA_2_EV_2009.cer"
157
158
159# E-Tugra
160# source: <rdar://15745238>
161# Test URL:  https://sslev.e-tugra.com.tr
162#
1632.16.792.3.0.4.1.1.4 "E-Tugra.der"
164
165# Entrust
166# 503006091D97D4F5AE39F7CBE7927D7D652D3431
167# B31EB1B740E36C8402DADC37D44DF5D4674952F9
168# 8CF427FD790C3AD166068DE81E57EFBB932272D4
169# 20d80640df9b25f512253a11eaf7598aeb14b547
170# TestURL: https://2048test.entrust.net/
171# TestURL: https://validev.entrust.net/
172# TestURL: https://validg2.entrust.net/
173# TestURL: https://validec.entrust.net/
174# source: <http://www.mozilla.org/projects/security/certs/included/>
175# confirmed by <http://www.entrust.net/CPS/pdf/webcps051404.pdf>
176#
177# (2.16.840.1.114028.10.1.2) = 060A6086480186FA6C0A0102
178#
179# root: Entrust.net Secure Server Certification Authority
180# root: Entrust Root Certification Authority
181#
182# confirmed by <sonr://99624119>
1832.16.840.1.114028.10.1.2 "EntrustEVRoot.crt" "EntrustRoot-G2.der" "EntrustRoot-EC1.der" "entrust2048.der"
184
185
186# GeoTrust
187# source: <http://www.mozilla.org/projects/security/certs/included/>
188# confirmed by <http://www.geotrust.com/resources/cps/pdfs/GeoTrustCPS-Version1.pdf>
189# G3 root added: <http://www.geotrust.com/resources/cps/pdfs/GeoTrustCPS-Version1.1.13.pdf>
190#
191# (1.3.6.1.4.1.14370.1.6) = 06092B06010401F0220106
192#
193# root: GeoTrust Primary Certification Authority
194# subordinate CA of: Equifax Secure Certificate Authority
195#
1961.3.6.1.4.1.14370.1.6 "geotrust-primary-ca.crt" "Equifax_Secure_Certificate_Auth" "GeoTrust Primary Certification Authority - G3.cer"
197
198
199# GlobalSign
200# source: <http://www.mozilla.org/projects/security/certs/included/>
201# confirmed by <https://www.globalsign.com/>
202#
203# (1.3.6.1.4.1.4146.1.1) = 06092B06010401A0320101
204#
205# root: GlobalSign Root CA - R3
206# root: GlobalSign Root CA - R2
207# root: GlobalSign Root CA
208#
2091.3.6.1.4.1.4146.1.1 "GlobalSignRootCA-R2.cer" "globalSignRoot.cer" "GlobalSign-Root-R3.der"
210
211
212# Go Daddy (aka Starfield Technologies)
213# source: <http://www.mozilla.org/projects/security/certs/included/>
214# confirmed by <https://certs.starfieldtech.com/repository/StarfieldCP-CPS.pdf>
215#
216# (2.16.840.1.114413.1.7.23.3) = 060B6086480186FD6D01071703
217# (2.16.840.1.114414.1.7.23.3) = 060B6086480186FD6E01071703
218#
219# root: Go Daddy Class 2 Certification Authority (for 114413)
220# root: Starfield Class 2 Certificate Authority (for 114414)
221# root: Starfield Root Certificate Authority - G2 (for 114414)
222# root: Starfield Services Root Certificate Authority - G2 (for 114414)
223# previously subordinate CA of: Valicert Class 2 Policy Validation Authority (both)
224#
2252.16.840.1.114413.1.7.23.3 "GD-Class2-root.crt" "GoDaddyRootCertificateAuthorityG2.der"
2262.16.840.1.114414.1.7.23.3 "SF-Class2-root.crt" "StarfieldRootCertificateAuthorityG2.der"
2272.16.840.1.114414.1.7.24.3 "StarfieldServicesRootCertificateAuthorityG2.der"
228
229
230# Izenpe
231# source: <sonr://Request/74637008>
232# source: <sonr://Request/84249406>
233# confirmed by <https://servicios.izenpe.com/jsp/descarga_ca/s27descarga_ca_c.jsp>
234#
235# (1.3.6.1.4.1.14777.6.1.1) =
236# (1.3.6.1.4.1.14777.6.1.2) =
237#
238# root: Izenpe.com
239# root: Izenpe.com/emailAddress=Info@izenpe.com
240#
2411.3.6.1.4.1.14777.6.1.1 "Izenpe-RAIZ2007.crt" "Izenpe-ca_raiz2003.crt"
2421.3.6.1.4.1.14777.6.1.2 "Izenpe-RAIZ2007.crt" "Izenpe-ca_raiz2003.crt"
243
244
245# KEYNECTIS (aka Certplus)
246# source: <sonr://request/76327342>
247# confirmed by <https://www.keynectis.com/fr/accueil.html>
248#
249# (1.3.6.1.4.1.22234.2.5.2.3.1) =
250#
251# root: Class 2 Primary CA
252#
2531.3.6.1.4.1.22234.2.5.2.3.1 "certplus_class2.der"
254
255
256# Logius (aka Staat der Nederlanden)
257# source: <rdar://problem/16256943> application for root trust store inclusion for Logius EV certificate
258# confirmed by <https://www.logius.nl/producten/toegang/pkioverheid/documentatie/certificaten-pkioverheid/staat-der-nederlanden-ev/>,
259# <https://bugzilla.mozilla.org/show_bug.cgi?id=1016568>
260# <http://cert.pkioverheid.nl/EVRootCA.cer>
261#
262# (2.16.528.1.1003.1.2.7) = 060960841001876B010207
263#
264# root: Staat der Nederlanden EV Root CA
265#
2662.16.528.1.1003.1.2.7 "Staat der Nederlanden EV Root CA.cer"
267
268
269# Network Solutions
270# source: <http://www.mozilla.org/projects/security/certs/included/>
271# confirmed by <https://www.networksolutions.com/legal/SSL-legal-repository-ev-cps.jsp>
272#
273# (1.3.6.1.4.1.782.1.2.1.8.1) = 060C2B06010401860E0102010801
274#
275# root: Network Solutions Certificate Authority
276# subordinate CA of: AddTrust External CA Root
277#
2781.3.6.1.4.1.782.1.2.1.8.1 "NetworkSolutionsEVRoot.crt" "AddTrust External CA Root.crt"
279
280
281# QuoVadis
282# source: <http://www.mozilla.org/projects/security/certs/included/>
283# confirmed by <http://www.quovadisglobal.bm/Repository.aspx>
284#
285# (1.3.6.1.4.1.8024.0.2.100.1.2) = 060C2B06010401BE580002640102
286#
287# root: QuoVadis Root Certification Authority
288# root: QuoVadis Root CA 2
289#
2901.3.6.1.4.1.8024.0.2.100.1.2 "qvrca.crt" "qvrca2.crt"
291
292
293# Secom (aka SECOM Trust Systems Co., Ltd.)
294# TestURL: https://scrootca2test.secomtrust.net also consider: https://fmctest.secomtrust.net/
295# FEB8C432DCF9769ACEAE3DD8908FFD288665647D
296# source: <https://repository.secomtrust.net/SC-Root1/>
297#
298# (1.2.392.200091.100.721.1) = 060A2A83088C9B1B64855101
299#
300# root: Security Communication RootCA1
301#
3021.2.392.200091.100.721.1 "SCRoot1ca.cer" "SECOM-EVRoot1ca.cer" "SECOM-RootCA2.cer"
303
304
305# StartCom
306# source: <http://www.mozilla.org/projects/security/certs/included/#StartCom>
307# confirmed by <https://www.startssl.com/certs/>, <https://www.startssl.com/policy.pdf>
308#
309# (1.3.6.1.4.1.23223.2) =
310# (1.3.6.1.4.1.23223.1.1.1) =
311#
312# root: StartCom Certification Authority
313#
3141.3.6.1.4.1.23223.2 "startcom-sfsca.der" "startcomSHA2.der" "StartCom May 2013 G2.der"
3151.3.6.1.4.1.23223.1.1.1 "startcom-sfsca.der" "startcomSHA2.der" "StartCom May 2013 G2.der"
316
317
318# SwissCom
319# source : <rdar://problem/13768455> SwissCom Root Certificates
320# TestURL: https://test-quarz-ev-ca-2.pre.swissdigicert.ch/
321# confirmed by <snrx://224162961>,
322# <http://www.swissdigicert.ch/sdcs/portal/open_pdf?file=deutsch%2F102_CPS_SDCS_EV_2_16_756_1_83_2_2_V2_1_de.pdf>
323#
324# previously, we had noted these additional OIDs for SwissCom:
325#   (2.16.756.1.83.20.1.1) = 06086085740153140101
326# verify whether this is still used: <rdar://15180773>
327#   (2.16.756.1.83.2.2) = 060760857401530202
328# <https://en.wikipedia.org/wiki/Extended_Validation_Certificate>; confirmed by Swisscom:
329#   (2.16.756.1.83.21.0) = 060760857401531500
330#
331# E7A19029D3D552DC0D0FC692D3EA880D152E1A6B
332#
3332.16.756.1.83.2.2 "Swisscom Root EV CA 2.cer"
3342.16.756.1.83.21.0 "Swisscom Root EV CA 2.cer"
335
336# SwissSign
337# source: <https://swisssign.com/english/download-document/20-swisssign-gold-ca-g2.html>
338# repository: https://swisssign.com/english/gold/view-category.html
339#
340# (2.16.756.1.89.1.2.1.1) = ...
341#
342# root: SwissSign Gold CA - G2
343#
3442.16.756.1.89.1.2.1.1 "SwissSign-Gold_G2.der"
345
346
347# TrustCenter (DE)
348# source: <sonr://Request/87508085>
349#
350# (1.2.276.0.44.1.1.1.4) = ...
351#
352# root: TC TrustCenter Universal CA III
353#
3541.2.276.0.44.1.1.1.4 "trustCenter-root-5.der"
355
356
357# Trustwave (aka SecureTrust, formerly XRamp)
358# source: <http://www.mozilla.org/projects/security/certs/included/>
359#
360# (2.16.840.1.114404.1.1.2.4.1) = 060C6086480186FD640101020401
361#
362# root: SecureTrust CA
363# root: Secure Global CA
364# root: XRamp Global CA
365# formerly subordinate CA of: Entrust.net Secure Server Certification Authority
366#
3672.16.840.1.114404.1.1.2.4.1 "Trustwave-STCA.der" "Trustwave-SGCA.der" "XGCA.crt"
368
369
370# Thawte
371# source: <http://www.mozilla.org/projects/security/certs/included/>
372# G3 EV root added: <http://www.thawte.com/assets/documents/repository/cps/Thawte_CPS_3_7.9.pdf>
373#
374# (2.16.840.1.113733.1.7.48.1) = 060B6086480186F84501073001
375#
376# root: thawte Primary Root CA
377# subordinate CA of: Thawte Premium Server CA
378#
3792.16.840.1.113733.1.7.48.1 "thawte-primary-root-ca.crt" "serverpremium.crt" "Thawte_Premium_Server_CA.cer" "thawte Primary Root CA - G3.cer"
380
381
382# T-TeleSec
383# source: <rdar://problem/14254092> T-Systems / Telesec.de root certificates
384#
385# (1.3.6.1.4.1.7879.13.24.1)
386#
387# root: T-TeleSec GlobalRoot Class 2 T-TeleSec GlobalRoot Class 3
388#
3891.3.6.1.4.1.7879.13.24.1 "T-TeleSec GlobalRoot Class 2.cer" "T-TeleSec GlobalRoot Class 3.cer"
390
391
392# VeriSign
393# source: <http://www.mozilla.org/projects/security/certs/included/>
394#
395# (2.16.840.1.113733.1.7.23.6) = 060B6086480186F84501071706
396#
397# root: VeriSign Class 3 Public Primary Certification Authority - G5
398# subordinate CA of: Class 3 Public Primary Certification Authority
399#
400# Symantec
401# source: <rdar://problem/13712338> Symantec ECC root certificates May 2013
402#
403# VeriSign
404# source: <rdar://13712338> Symantec ECC root certificates May 2013
405# EV OID correction: <rdar://17095623> EV-enablement for Verisign root certificate already in the keychain
406#
4072.16.840.1.113733.1.7.23.6 "VeriSignC3PublicPrimaryCA-G5.cer" "PCA3ss_v4.509" "Symantec Class 3 Public Primary Certification Authority - G4.cer" "VeriSign Class 3 Public Primary Certification Authority - G4.cer" "VeriSign Universal Root Certification Authority.cer"
408
409
410# Wells Fargo
411# source: <sonr://request/72493272>
412# confirmed by <https://www.wellsfargo.com/com/cp>
413#
414# (2.16.840.1.114171.500.9) = 060A6086480186FB7B837409
415#
416# root: WellsSecure Public Root Certificate Authority
417#
4182.16.840.1.114171.500.9 "WellsSecurePRCA.der"
419
420
421# Camerfirma
422# TestURL: https://server2.camerfirma.com:8082
423# TestURL: https://www.camerfirma.com/
424# confirmed by <snrx://277093627>
425#
426# (1.3.6.1.4.1.17326.10.14.2.1.2) = 060D2B0601040181872E0A0E020102
427# (1.3.6.1.4.1.17326.10.8.12.1.2) = 060D2B0601040181872E0A080C0102
428#
429# 786A74AC76AB147F9C6A3050BA9EA87EFE9ACE3C
430# 6E3A55A4190C195C93843CC0DB722E313061F0B1
431#
4321.3.6.1.4.1.17326.10.14.2.1.2 "ROOT-CHAMBERSIGN.crt" "ROOT-CHAMBERS.crt" "root_chambers-2008.der"
4331.3.6.1.4.1.17326.10.8.12.1.2 "root_chambersign-2008.der"
434
435
436# Firmaprofesional
437# AEC5FB3FC8E1BFC4E54F03075A9AE800B7F7B6FA
438# Firmaprofesional-CIF-A62634068.der
439# TestURL: https://publifirma.firmaprofesional.com/
440# confirmed by <sonr://230298678>
441#
442# (1.3.6.1.4.1.13177.10.1.3.10) = 060B2B06010401E6790A01030A
443#
4441.3.6.1.4.1.13177.10.1.3.10 "Firmaprofesional-CIF-A62634068.der"
445
446
447# TWCA
448# TestURL (4096): https://evssldemo3.twca.com.tw/index.html
449# TestURL (2048): https://evssldemo.twca.com.tw/index.html
450# confirmed with Robin Lin of TWCA on August 13 2013
451#
452# (1.3.6.1.4.1.40869.1.1.22.3) = 060C2B0601040182BF2501011603
453#
454#  9CBB4853F6A4F6D352A4E83252556013F5ADAF65
455#  CF9E876DD3EBFC422697A3B5A37AA076A9062348
456#
4571.3.6.1.4.1.40869.1.1.22.3 "TWCARootCA-4096.der" "twca-root-1.der"
458
459
460
461# ------------------------------------------------------------------------------
462
463