[squid-users] Blocking compromised intermediate certificates (eMudhra incident)
Stuart Henderson
stu.lists at spacehopper.org
Fri Oct 23 12:30:29 UTC 2026
On 2026-10-23, Andrey K <ankor2023 at gmail.com> wrote:
> I would like to know if there is a way to configure Squid to block sites
> that have the compromised intermediate certificates in their certification
> chains. I do not want to untrust or block the Root certificates, only the
> specific compromised intermediates.
Not afaik in Squid. This may be of interest though: OpenBSD dropped
"emSign ECC Root CA - C3" (the first line of the b64-encoded cert
is "MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG")
and replaced it with a modified version of the not-distrusted
intermediates. As a result, certs signed with the various eMudhra
and InCommon ECC intermediates are still verifiable.
>From new OpenBSD cert.pem, those intermediates are:
### eMudhra intermediates re-issued as local anchors (emSign ECC Root CA - G3 removed)
###
### These were added as elided intermediates in response to the removal
### of the eMudhra G3 root which had 8 compromised intermediates
### with trivial keys, (such as '4') as of 2026-10-20. These
### are intermediates promoted to roots by making their issuer
### be themselves, (the same way netscape does this). the signatures
### will not match but are not checked, so this is fine.
### These roots should be removed in a future release, likely
### within a year. - beck@
=== /C=IN/O=eMudhra Technologies Limited/CN=EM DV TLS CA - G3A-1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
a3:e5:ad:9d:0c:03:74:a3:42:e5:e2:a3:f5:06:dd
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=IN, O=eMudhra Technologies Limited, CN=EM DV TLS CA - G3A-1
Validity
Not Before: May 29 07:37:34 2025 GMT
Not After : May 28 07:37:34 2040 GMT
Subject: C=IN, O=eMudhra Technologies Limited, CN=EM DV TLS CA - G3A-1
X509v3 extensions:
X509v3 Subject Key Identifier:
AB:28:96:83:69:3E:C4:49:71:F5:14:8A:65:47:21:A3:70:22:B6:53
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.50977.1.0.1
CPS: http://repository.emsign.com
Policy: 1.3.6.1.4.1.50977.1.2.100
Policy: 2.23.140.1.2.1
Authority Information Access:
OCSP - URI:http://ocsp-a.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/EMDVTLSCAG3A1.p7c
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=E9:48:24:07:C9:98:9B:F2:01:49:32:BE:F6:38:D8:BC:B2:2B:70:14
SHA256 Fingerprint=CC:8C:C1:49:D9:78:32:49:8A:66:75:94:F5:36:47:AD:C2:9E:76:D7:9B:F6:9D:2A:6C:F6:E7:DA:B4:20:43:C1
-----BEGIN CERTIFICATE-----
MIIDWjCCAt+gAwIBAgIQAKPlrZ0MA3SjQuXio/UG3TAKBggqhkjOPQQDAzBTMQsw
CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
ZDEdMBsGA1UEAwwURU0gRFYgVExTIENBIC0gRzNBLTEwHhcNMjUwNTI5MDczNzM0
WhcNNDAwNTI4MDczNzM0WjBTMQswCQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhy
YSBUZWNobm9sb2dpZXMgTGltaXRlZDEdMBsGA1UEAwwURU0gRFYgVExTIENBIC0g
RzNBLTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQRUwsnMytXSYliy+Fhd0lC+vBj
GHhMPDHe+mMutAJ9JT5LItComlAU2zX3KbqRG/uha2F3QFE6WvKDnrk0/zp0sV6w
f9HwX6Ldx2SeMdXmNsI3/DpFC1VI75D8GMCJ5o2jggF2MIIBcjAdBgNVHQ4EFgQU
qyiWg2k+xElx9RSKZUcho3AitlMwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYcaHR0
cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEEAYOOIQECZDAIBgZngQwB
AgEwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC1hLmVt
c2lnbi5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5j
b20vY2VydHMvRU1EVlRMU0NBRzNBMS5wN2MwNwYDVR0fBDAwLjAsoCqgKIYmaHR0
cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5jcmwwDgYDVR0PAQH/BAQD
AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0EAwMDaQAwZgIxAM6VEqwj
prpIH4rVMp25YZc186AL5thCEmnq+OKDPHbv/Q47mQK1gOMxegPEBcCGSwIxAMPx
aTqIpExzKiwHf0sLBOaVa+5loIRZekaNOqR0xYrj0p920+G8F8hxPzUD7BkCDA==
-----END CERTIFICATE-----
=== /C=IN/O=eMudhra Technologies Limited/CN=EM EV TLS CA - G3A-1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
b2:89:71:d9:98:9a:62:9c:a9:b4:e2:06:06:72:11
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=IN, O=eMudhra Technologies Limited, CN=EM EV TLS CA - G3A-1
Validity
Not Before: May 29 07:44:09 2025 GMT
Not After : May 28 07:44:09 2040 GMT
Subject: C=IN, O=eMudhra Technologies Limited, CN=EM EV TLS CA - G3A-1
X509v3 extensions:
X509v3 Subject Key Identifier:
4A:BA:B8:73:55:C2:6A:1B:F9:F6:00:BB:6E:B2:62:15:7E:C7:0B:12
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.50977.1.0.1
CPS: http://repository.emsign.com
Policy: 1.3.6.1.4.1.50977.1.2.120
Policy: 2.23.140.1.1
Authority Information Access:
OCSP - URI:http://ocsp-a.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/EMEVTLSCAG3A1.p7c
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=86:E1:0D:F4:88:8F:52:66:0C:4A:BC:1C:58:F5:CF:08:C8:C1:1F:19
SHA256 Fingerprint=13:84:AE:F6:B8:24:27:FD:EA:FD:1E:CF:29:AF:6B:BD:77:61:02:31:59:A7:4D:F1:DA:9F:E2:43:A9:39:82:83
-----BEGIN CERTIFICATE-----
MIIDVzCCAt6gAwIBAgIQALKJcdmYmmKcqbTiBgZyETAKBggqhkjOPQQDAzBTMQsw
CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
ZDEdMBsGA1UEAwwURU0gRVYgVExTIENBIC0gRzNBLTEwHhcNMjUwNTI5MDc0NDA5
WhcNNDAwNTI4MDc0NDA5WjBTMQswCQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhy
YSBUZWNobm9sb2dpZXMgTGltaXRlZDEdMBsGA1UEAwwURU0gRVYgVExTIENBIC0g
RzNBLTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASX8UUmj9n8ThagBj1vWYZoQXdu
J+wl9PFDVr02D/S1TvJ1sNIHC3yFzeojNYSzGN0/NEU/ELzfZw2f/GAr7lgvj/vt
NXTMNKjLFwGQEbOYWwQUR+FckKPcKJOMiRGYMBGjggF1MIIBcTAdBgNVHQ4EFgQU
Srq4c1XCahv59gC7brJiFX7HCxIwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMFwGA1UdIARVMFMwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYcaHR0
cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEEAYOOIQECeDAHBgVngQwB
ATB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLWEuZW1z
aWduLmNvbTBABggrBgEFBQcwAoY0aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNv
bS9jZXJ0cy9FTUVWVExTQ0FHM0ExLnA3YzA3BgNVHR8EMDAuMCygKqAohiZodHRw
Oi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNybDAOBgNVHQ8BAf8EBAMC
AQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNnADBkAjBl72Ihco/O
Gb3veVX0kRaBe/PQG9XNfTC6qI1060TeCnO10jRGCri0boTefDsCQWkCMGHlh2vF
2mOraThsSDbbUm4v7oGoqW44z+EObTjreafj8CB++LNy5+GoOAGx1erzdQ==
-----END CERTIFICATE-----
=== /C=IN/O=eMudhra Technologies Limited/CN=EM OV TLS CA - G3A-1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
c5:fb:5f:2d:43:07:1f:5b:56:23:b5:d1:32:87:8c
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=IN, O=eMudhra Technologies Limited, CN=EM OV TLS CA - G3A-1
Validity
Not Before: May 29 07:41:16 2025 GMT
Not After : May 28 07:41:16 2040 GMT
Subject: C=IN, O=eMudhra Technologies Limited, CN=EM OV TLS CA - G3A-1
X509v3 extensions:
X509v3 Subject Key Identifier:
06:4E:B5:99:F6:61:9B:45:B9:95:56:FE:7D:C6:A1:15:FC:D5:D1:1D
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.50977.1.0.1
CPS: http://repository.emsign.com
Policy: 1.3.6.1.4.1.50977.1.2.110
Policy: 2.23.140.1.2.2
Authority Information Access:
OCSP - URI:http://ocsp-a.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/EMOVTLSCAG3A1.p7c
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=D5:00:A5:D8:01:07:D3:2A:9C:7F:D7:25:4D:4E:E9:05:0F:66:9F:F7
SHA256 Fingerprint=3B:71:45:C3:55:31:49:C1:91:00:84:7A:63:DC:CC:79:DC:EF:DE:70:64:D4:63:55:F5:DF:D5:9F:70:93:DC:E6
-----BEGIN CERTIFICATE-----
MIIDWTCCAt+gAwIBAgIQAMX7Xy1DBx9bViO10TKHjDAKBggqhkjOPQQDAzBTMQsw
CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
ZDEdMBsGA1UEAwwURU0gT1YgVExTIENBIC0gRzNBLTEwHhcNMjUwNTI5MDc0MTE2
WhcNNDAwNTI4MDc0MTE2WjBTMQswCQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhy
YSBUZWNobm9sb2dpZXMgTGltaXRlZDEdMBsGA1UEAwwURU0gT1YgVExTIENBIC0g
RzNBLTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT6UYdSWd0jymhc8bcZKRUx63uu
+ZcmYxCcfvqmBhAe0pxajDCr5itK2y3DdDzgqASumn3FAKaY3H0FfzxevJIexj3t
/JYxif45x9C14s0b8DlQIdlKMmvMJvaaVYPOmDKjggF2MIIBcjAdBgNVHQ4EFgQU
Bk61mfZhm0W5lVb+fcahFfzV0R0wHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYcaHR0
cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEEAYOOIQECbjAIBgZngQwB
AgIwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC1hLmVt
c2lnbi5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5j
b20vY2VydHMvRU1PVlRMU0NBRzNBMS5wN2MwNwYDVR0fBDAwLjAsoCqgKIYmaHR0
cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5jcmwwDgYDVR0PAQH/BAQD
AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0EAwMDaAAwZQIwLUee2Eeo
pAnH8xx6OLtbyj1Ymom4hoVCUVl3ZUJjXL7QLMxuJ+xX5r868zbvYk1RAjEA0sF3
/FUXzVSE4ThfNCNSZF5jq6nIsQ1EB84KI2Qtw2Dx+aoAWYfpVL5yeXODkP+9
-----END CERTIFICATE-----
=== /C=US/O=Internet2/CN=InCommon Intermediate CA - DVG3C
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
ce:96:67:07:d5:d2:8a:7a:e8:ab:6f:00:63:1b:4f
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=US, O=Internet2, CN=InCommon Intermediate CA - DVG3C
Validity
Not Before: Apr 8 19:59:38 2026 GMT
Not After : Apr 7 19:59:38 2029 GMT
Subject: C=US, O=Internet2, CN=InCommon Intermediate CA - DVG3C
X509v3 extensions:
X509v3 Subject Key Identifier:
5B:D5:00:2C:75:E0:A2:DA:C0:28:5E:82:F2:8E:44:7E:01:88:8F:37
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
CPS: https://incommon.org/certificates/repository
Policy: 1.3.6.1.4.1.50977.1.2.100
Policy: 2.23.140.1.2.1
Authority Information Access:
OCSP - URI:http://ocsp-c.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonDVG3C.p7c
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=C6:01:EF:B9:C7:B9:8E:EE:77:5A:A1:B5:82:73:97:3D:3D:B5:CA:30
SHA256 Fingerprint=4B:EE:F1:05:80:67:18:07:FE:54:2D:E2:71:3C:B5:5B:1D:62:77:C1:9D:A6:BF:FE:86:E7:90:02:60:04:FF:EA
-----BEGIN CERTIFICATE-----
MIIDVDCCAtqgAwIBAgIQAM6WZwfV0op66KtvAGMbTzAKBggqhkjOPQQDAzBMMQsw
CQYDVQQGEwJVUzESMBAGA1UECgwJSW50ZXJuZXQyMSkwJwYDVQQDDCBJbkNvbW1v
biBJbnRlcm1lZGlhdGUgQ0EgLSBEVkczQzAeFw0yNjA0MDgxOTU5MzhaFw0yOTA0
MDcxOTU5MzhaMEwxCzAJBgNVBAYTAlVTMRIwEAYDVQQKDAlJbnRlcm5ldDIxKTAn
BgNVBAMMIEluQ29tbW9uIEludGVybWVkaWF0ZSBDQSAtIERWRzNDMHYwEAYHKoZI
zj0CAQYFK4EEACIDYgAEVV7YirHQnlyAASlb4CHombkBm1bEcE8Ht90TUuvKFMkM
zphN/KVRxQuQoApfiyYtjHVgiGOBo3M2F9TgFBHzAQlr+kEf22cdH6dvNsGk5dsh
c3MFIommLI5VqWjni9F0o4IBfzCCAXswHQYDVR0OBBYEFFvVACx14KLawChegvKO
RH4BiI83MBMGA1UdJQQMMAoGCCsGAQUFBwMBMG4GA1UdIARnMGUwSgYMKwYBBAGu
IwEEAwECMDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vaW5jb21tb24ub3JnL2NlcnRp
ZmljYXRlcy9yZXBvc2l0b3J5MA0GCysGAQQBg44hAQJkMAgGBmeBDAECATB4Bggr
BgEFBQcBAQRsMGowJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLWMuZW1zaWduLmNv
bTBCBggrBgEFBQcwAoY2aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbS9jZXJ0
cy9FTUluY29tbW9uRFZHM0MucDdjMDcGA1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9j
cmwuZW1zaWduLmNvbS8/cm9vdHRsc2NhZzMuY3JsMA4GA1UdDwEB/wQEAwIBBjAS
BgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2gAMGUCMQCvqlaA3K9geq2t
CtV38sCflK7yU0Upe7opjcx2bLfbnp1PTNTrafgoBryqLZFC1rACMHY9fKYC3163
KW1DlpKbteLM5C25jGoShpJ+Y6kDh8RGVL7dhlOmTq4dVfPgV9l6MQ==
-----END CERTIFICATE-----
=== /C=US/O=Internet2/CN=InCommon Intermediate CA - EVG3C
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
c6:1d:1c:f7:7f:a6:d4:c8:88:75:a4:3b:eb:4a:e4
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=US, O=Internet2, CN=InCommon Intermediate CA - EVG3C
Validity
Not Before: Apr 8 20:03:19 2026 GMT
Not After : Apr 7 20:03:19 2029 GMT
Subject: C=US, O=Internet2, CN=InCommon Intermediate CA - EVG3C
X509v3 extensions:
X509v3 Subject Key Identifier:
7D:C8:B6:61:09:20:42:94:C4:7F:A0:17:45:C6:3F:DD:9B:38:1B:BC
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
CPS: https://incommon.org/certificates/repository
Policy: 1.3.6.1.4.1.50977.1.2.120
Policy: 2.23.140.1.1
Authority Information Access:
OCSP - URI:http://ocsp-c.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonEVG3C.p7c
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=1D:66:05:F3:E7:12:88:D1:4B:4B:E8:E2:C2:B0:56:EF:A1:5D:7F:45
SHA256 Fingerprint=8A:AD:B3:28:A5:0E:8C:43:EC:E2:53:D5:E1:5D:60:4B:8B:CC:C7:84:CE:23:F0:37:70:2A:F0:A8:E8:A0:A9:61
-----BEGIN CERTIFICATE-----
MIIDUjCCAtmgAwIBAgIQAMYdHPd/ptTIiHWkO+tK5DAKBggqhkjOPQQDAzBMMQsw
CQYDVQQGEwJVUzESMBAGA1UECgwJSW50ZXJuZXQyMSkwJwYDVQQDDCBJbkNvbW1v
biBJbnRlcm1lZGlhdGUgQ0EgLSBFVkczQzAeFw0yNjA0MDgyMDAzMTlaFw0yOTA0
MDcyMDAzMTlaMEwxCzAJBgNVBAYTAlVTMRIwEAYDVQQKDAlJbnRlcm5ldDIxKTAn
BgNVBAMMIEluQ29tbW9uIEludGVybWVkaWF0ZSBDQSAtIEVWRzNDMHYwEAYHKoZI
zj0CAQYFK4EEACIDYgAEVQAx9tqWAMeJeBOAYyFS0TCa+JbYcXPYdwR6pHRLNDrP
+yQr1Mhm3guxO6zgjxjo7rnZyrAWUfEyKfU8QtajexMhHwGV1QvcvwWJPz1Vc9ex
NXmItpVLuoTyWYpZZqH5o4IBfjCCAXowHQYDVR0OBBYEFH3ItmEJIEKUxH+gF0XG
P92bOBu8MBMGA1UdJQQMMAoGCCsGAQUFBwMBMG0GA1UdIARmMGQwSgYMKwYBBAGu
IwEEAwECMDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vaW5jb21tb24ub3JnL2NlcnRp
ZmljYXRlcy9yZXBvc2l0b3J5MA0GCysGAQQBg44hAQJ4MAcGBWeBDAEBMHgGCCsG
AQUFBwEBBGwwajAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AtYy5lbXNpZ24uY29t
MEIGCCsGAQUFBzAChjZodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tL2NlcnRz
L0VNSW5jb21tb25FVkczQy5wN2MwNwYDVR0fBDAwLjAsoCqgKIYmaHR0cDovL2Ny
bC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5jcmwwDgYDVR0PAQH/BAQDAgEGMBIG
A1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0EAwMDZwAwZAIwH1kAbzeM/D/yBYcM
k9AeJWem/+APRK33c6pkzkKoy2Fs5w6HFSQ+po+O1Gi8gI2+AjBqGzwX8GG8jEoB
sCJQQJGOT1DmeIeMNgNYAFImPpEVoc0FZHUWnJJr1PySrPv7vIE=
-----END CERTIFICATE-----
=== /C=US/O=Internet2/CN=InCommon Intermediate CA - OVG3C
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
66:a1:1f:39:6c:e7:bd:4e:fb:9e:b9:62:08:d6:f3
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=US, O=Internet2, CN=InCommon Intermediate CA - OVG3C
Validity
Not Before: Apr 8 20:01:32 2026 GMT
Not After : Apr 7 20:01:32 2029 GMT
Subject: C=US, O=Internet2, CN=InCommon Intermediate CA - OVG3C
X509v3 extensions:
X509v3 Subject Key Identifier:
39:0B:B7:AA:1B:9A:DA:A6:1B:98:9C:A8:BC:87:44:99:6E:24:00:62
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Certificate Policies:
Policy: 1.3.6.1.4.1.5923.1.4.3.1.2
CPS: https://incommon.org/certificates/repository
Policy: 1.3.6.1.4.1.50977.1.2.110
Policy: 2.23.140.1.2.2
Authority Information Access:
OCSP - URI:http://ocsp-c.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/EMIncommonOVG3C.p7c
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=2F:AD:FF:7B:11:7E:EC:27:C9:68:46:CF:9F:E1:E3:DD:8D:09:08:1B
SHA256 Fingerprint=96:3B:A1:8A:4F:86:B1:D0:5E:4C:30:37:5C:90:DA:AE:ED:01:8B:07:52:64:98:00:FF:CE:8A:BE:C0:A5:13:4B
-----BEGIN CERTIFICATE-----
MIIDUzCCAtmgAwIBAgIPZqEfOWznvU77nrliCNbzMAoGCCqGSM49BAMDMEwxCzAJ
BgNVBAYTAlVTMRIwEAYDVQQKDAlJbnRlcm5ldDIxKTAnBgNVBAMMIEluQ29tbW9u
IEludGVybWVkaWF0ZSBDQSAtIE9WRzNDMB4XDTI2MDQwODIwMDEzMloXDTI5MDQw
NzIwMDEzMlowTDELMAkGA1UEBhMCVVMxEjAQBgNVBAoMCUludGVybmV0MjEpMCcG
A1UEAwwgSW5Db21tb24gSW50ZXJtZWRpYXRlIENBIC0gT1ZHM0MwdjAQBgcqhkjO
PQIBBgUrgQQAIgNiAAQu7lYpcB3m+l6auU0Te6ORUVztQEM55Y4u5eRfbYiijOCx
2MNIfF0i3HdNGVjlG+YPtCVFKJKMiSRBX/NYmHKr8mzRVsaAxscu/pIBUHaDIWu0
3vLXfQWix/mCKdxJu8ejggF/MIIBezAdBgNVHQ4EFgQUOQu3qhua2qYbmJyovIdE
mW4kAGIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwbgYDVR0gBGcwZTBKBgwrBgEEAa4j
AQQDAQIwOjA4BggrBgEFBQcCARYsaHR0cHM6Ly9pbmNvbW1vbi5vcmcvY2VydGlm
aWNhdGVzL3JlcG9zaXRvcnkwDQYLKwYBBAGDjiEBAm4wCAYGZ4EMAQICMHgGCCsG
AQUFBwEBBGwwajAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AtYy5lbXNpZ24uY29t
MEIGCCsGAQUFBzAChjZodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tL2NlcnRz
L0VNSW5jb21tb25PVkczQy5wN2MwNwYDVR0fBDAwLjAsoCqgKIYmaHR0cDovL2Ny
bC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5jcmwwDgYDVR0PAQH/BAQDAgEGMBIG
A1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0EAwMDaAAwZQIwbLGL1SLTFzN/XC2R
mTDJG1fOKzFoqt4PAeATMGRdZqfBWvlaSZ2jXXcTq5i6pHkzAjEA5T7XqBJ9yYC+
PuOmdyc0ZQ1vPZC0lNkS999FQOTZyTcCNeZca4eYXL+ZIqupqtws
-----END CERTIFICATE-----
=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC EV SSL CA - G3
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
01:fe:3e:6c:68:de:bb:ec:26:3e
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC EV SSL CA - G3
Validity
Not Before: Feb 18 18:30:00 2018 GMT
Not After : Feb 18 18:30:00 2033 GMT
Subject: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC EV SSL CA - G3
X509v3 extensions:
X509v3 Subject Key Identifier:
D1:AA:B4:D2:D2:25:82:4E:B3:F0:93:60:17:4A:9B:63:7A:F9:1F:0D
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: X509v3 Any Policy
CPS: http://repository.emsign.com
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
Authority Information Access:
OCSP - URI:http://ocsp.emsign.com
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com?RootCAG3.crl
SHA1 Fingerprint=6D:D1:43:8B:6E:D4:A2:BB:B6:0F:EC:6F:85:EA:0B:F5:51:48:23:29
SHA256 Fingerprint=4A:82:09:67:F1:D7:69:C2:C8:94:58:CF:ED:A4:4C:BD:C8:52:3F:7C:04:6F:33:10:E1:BF:EC:1B:78:81:85:28
-----BEGIN CERTIFICATE-----
MIIDHzCCAqWgAwIBAgIKAf4+bGjeu+wmPjAKBggqhkjOPQQDAzBtMQswCQYDVQQG
EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
bm9sb2dpZXMgTGltaXRlZDEiMCAGA1UEAxMZZW1TaWduIEVDQyBFViBTU0wgQ0Eg
LSBHMzAeFw0xODAyMTgxODMwMDBaFw0zMzAyMTgxODMwMDBaMG0xCzAJBgNVBAYT
AklOMRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hu
b2xvZ2llcyBMaW1pdGVkMSIwIAYDVQQDExllbVNpZ24gRUNDIEVWIFNTTCBDQSAt
IEczMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEtlehqaFhr9bBYTSes0KjaVzNozYD
fm7n1OY7GwhtPezhtvkqRc+3fH/kBrv27F/6beBzd8U/Ft7cWO9ldjZ429s0ZbgJ
f+lB02lvBXGkyDr8X6gX04weT2+r3gpDX5Rgo4IBDjCCAQowHQYDVR0OBBYEFNGq
tNLSJYJOs/CTYBdKm2N6+R8NMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggr
BgEFBQcDAQYIKwYBBQUHAwIwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUH
AgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wEgYDVR0TAQH/BAgwBgEB
/wIBADAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLmVt
c2lnbi5jb20wMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29t
P1Jvb3RDQUczLmNybDAKBggqhkjOPQQDAwNoADBlAjEA85IdtRPYzzTkoyMwSivZ
6m4ujJwq7Cewaa2LGf6jOW8K4lL6yr72idEOSDC0beKoAjABiWsX3omaFbsk3knJ
iX8Ly0rR3fQ3yz8+TcN6eHcrI+FKJ/s84xzzYO8epYsv5LQ=
-----END CERTIFICATE-----
=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC SSL CA - G3
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
72:dd:c7:e9:dc:e9:b0:dc:ff:c7
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC SSL CA - G3
Validity
Not Before: Feb 18 18:30:00 2018 GMT
Not After : Feb 18 18:30:00 2033 GMT
Subject: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC SSL CA - G3
X509v3 extensions:
X509v3 Subject Key Identifier:
13:8D:4C:28:99:E1:62:B7:D2:E0:53:E3:18:D1:62:DC:1C:CA:66:FA
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: X509v3 Any Policy
CPS: http://repository.emsign.com
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
Authority Information Access:
OCSP - URI:http://ocsp.emsign.com
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com?RootCAG3.crl
SHA1 Fingerprint=90:7F:08:83:3D:3D:A5:4C:59:F6:1A:29:98:C7:37:3A:E6:F4:35:10
SHA256 Fingerprint=4C:C5:04:79:40:A4:62:53:B1:1F:24:6D:A9:F7:E4:5D:6A:17:8C:D3:FD:B7:57:4D:A5:D7:4A:C8:0B:D6:18:88
-----BEGIN CERTIFICATE-----
MIIDGjCCAp+gAwIBAgIKct3H6dzpsNz/xzAKBggqhkjOPQQDAzBqMQswCQYDVQQG
EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
bm9sb2dpZXMgTGltaXRlZDEfMB0GA1UEAxMWZW1TaWduIEVDQyBTU0wgQ0EgLSBH
MzAeFw0xODAyMTgxODMwMDBaFw0zMzAyMTgxODMwMDBaMGoxCzAJBgNVBAYTAklO
MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv
Z2llcyBMaW1pdGVkMR8wHQYDVQQDExZlbVNpZ24gRUNDIFNTTCBDQSAtIEczMHYw
EAYHKoZIzj0CAQYFK4EEACIDYgAEFbClpoPxYYQiXHW5Dob0VjfnL4AnR7CChd5k
9dzPY6SQPpY2ohMxKf43OXbjz0hNRTkYfQSmNa66NC/qy0Ri6V7sBVvs6iVmy/N4
xd2r/aDkMdcaVbUUZzXQNjH73HKeo4IBDjCCAQowHQYDVR0OBBYEFBONTCiZ4WK3
0uBT4xjRYtwcymb6MA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcD
AQYIKwYBBQUHAwIwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0
dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wEgYDVR0TAQH/BAgwBgEB/wIBADAy
BggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLmVtc2lnbi5j
b20wMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL2NybC5lbXNpZ24uY29tP1Jvb3RD
QUczLmNybDAKBggqhkjOPQQDAwNpADBmAjEA/TOH8/C+zUpaWu4H6KrBJdZdRfEn
lFy82GgyhPkerXrgryLiVvi19U1Xgdvz0d+6AjEA1dQWknkO8O6AGYaxYiHdQMtj
8xogmvQsLIHe95vCobB5immuJBzLGp4bjEJdgs5y
-----END CERTIFICATE-----
=== /C=IN/O=eMudhra Technologies Limited/CN=emSign TLS CA - G3
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
3b:6e:ce:c8:69:f6:77:ef:f3:34:45:c0:e3:ed:c5
Signature Algorithm: ecdsa-with-SHA384
Issuer: C=IN, O=eMudhra Technologies Limited, CN=emSign TLS CA - G3
Validity
Not Before: Jul 11 16:42:13 2024 GMT
Not After : Jul 8 18:30:00 2039 GMT
Subject: C=IN, O=eMudhra Technologies Limited, CN=emSign TLS CA - G3
X509v3 extensions:
X509v3 Subject Key Identifier:
65:D4:B5:57:37:F5:44:58:61:0C:6C:2F:3D:75:55:EA:B0:2A:60:33
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Certificate Policies:
Policy: X509v3 Any Policy
CPS: http://repository.emsign.com
Authority Information Access:
OCSP - URI:http://ocsp.emsign.com
CA Issuers - URI:http://repository.emsign.com/certs/roottlscag3.crt
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.emsign.com/?roottlscag3.crl
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
SHA1 Fingerprint=EA:3C:E7:AA:AA:6B:17:7E:E5:9F:2A:BD:DA:B4:B7:A6:DD:AE:1A:13
SHA256 Fingerprint=93:9F:A3:07:7F:40:E1:A4:A7:DD:51:21:70:A9:59:6F:E6:64:1A:2C:F1:50:33:93:6C:B0:0A:29:7C:E1:32:C3
-----BEGIN CERTIFICATE-----
MIIDMTCCAragAwIBAgIPO27OyGn2d+/zNEXA4+3FMAoGCCqGSM49BAMDMFExCzAJ
BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
MRswGQYDVQQDDBJlbVNpZ24gVExTIENBIC0gRzMwHhcNMjQwNzExMTY0MjEzWhcN
MzkwNzA4MTgzMDAwWjBRMQswCQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBU
ZWNobm9sb2dpZXMgTGltaXRlZDEbMBkGA1UEAwwSZW1TaWduIFRMUyBDQSAtIEcz
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ0pPaNZ7vn6zEyQy3/cjM4iDOPew9vZD
T53GhvZSYSPebuy7wYNVb2tuBDYyo1DGGFek3L9ljT/kUFl+94WQWGmK8SO9nhjM
Hx4Zf+yzf2VPSecwrnohKL6TCRhruQYko4IBUjCCAU4wHQYDVR0OBBYEFGXUtVc3
9URYYQxsLz11VeqwKmAzMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjA9
BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRv
cnkuZW1zaWduLmNvbTByBggrBgEFBQcBAQRmMGQwIgYIKwYBBQUHMAGGFmh0dHA6
Ly9vY3NwLmVtc2lnbi5jb20wPgYIKwYBBQUHMAKGMmh0dHA6Ly9yZXBvc2l0b3J5
LmVtc2lnbi5jb20vY2VydHMvcm9vdHRsc2NhZzMuY3J0MDcGA1UdHwQwMC4wLKAq
oCiGJmh0dHA6Ly9jcmwuZW1zaWduLmNvbS8/cm9vdHRsc2NhZzMuY3JsMA4GA1Ud
DwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYC
MQDx8jmw++Y6CrwfbvIoyH8flnU/3/vbncdFvgHccfUi/yEuIXM94oMvbz9hVqlF
sj4CMQC5wLIrBo2ATYlvsKqhjPNHtgLgD6mJ//m6icUsySfMTuvSMjbhKNGsgEpJ
NNH0Am4=
-----END CERTIFICATE-----
=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign Root CA - G1
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
31:f5:e4:62:0c:6c:58:ed:d6:d8
Signature Algorithm: sha256WithRSAEncryption
Validity
Not Before: Feb 18 18:30:00 2018 GMT
Not After : Feb 18 18:30:00 2043 GMT
Subject: C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign Root CA - G1
X509v3 extensions:
X509v3 Subject Key Identifier:
FB:EF:0D:86:9E:B0:E3:DD:A9:B9:F1:21:17:7F:3E:FC:F0:77:2B:1A
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
SHA1 Fingerprint=8A:C7:AD:8F:73:AC:4E:C1:B5:75:4D:A5:40:F4:FC:CF:7C:B5:8E:8C
SHA256 Fingerprint=40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67
-----BEGIN CERTIFICATE-----
MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD
VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU
ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH
MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO
MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv
Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz
f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO
8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq
d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM
tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt
Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB
o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD
AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x
PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM
wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d
GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH
6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby
RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx
iN66zB+Afko=
-----END CERTIFICATE-----
More information about the squid-users
mailing list