Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 S Hanley Rd, #800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
We have examined ATS management’s assertion that for its Certification Authority (“CA”)
operations in the United States of America, throughout the period January 16, 2016 to January
15, 2017 for its root CAs known as Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3,
Amazon Root CA 4, Starfield Services Root Certificate Authority - G2 and other CAs listed inAppendix A, ATS has:xdisclosed its business, key lifecycle management, certificate lifecycle management, andCA environment control practices in its:o Amazon Trust Services Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5

xmaintained effective controls to provide reasonable assurance that:o ATS’ Certification Practice Statement is consistent with its Certificate Policy; ando ATS provides its services in accordance with its Certificate Policy and Certification
Practice Statementxmaintained effective controls to provide reasonable assurance that:o the integrity of keys and certificates it manages is established and protected
throughout their lifecycles;o the integrity of subscriber keys and certificates it manages is established andprotected throughout their lifecycles;
o subscriber information is properly authenticated; ando subordinate CA certificate requests are accurate, authenticated, and approvedx

maintained effective controls to provide reasonable assurance that:o logical and physical access to CA systems and data is restricted to authorizedindividuals;o the continuity of key and certificate management operations is maintained; ando CA systems development, maintenance, and operations are properly authorized
and performed to maintain CA systems integrity
based on the Trust Service Principles and Criteria for Certification Authorities, Version 2.0.
ATS’ management is responsible for its assertion. Our responsibility is to express an opinion on
management’s assertion based on our examination.
We conducted our examination in accordance with standards for attestation engagements
established by the American Institute of Certified Public Accountants and, accordingly, included:(1) obtaining an understanding of ATS’ key and certificate lifecycle management businesspractices and its controls over key and certificate integrity, over the authenticity andconfidentiality of subscriber and relying party information, over the continuity of key andcertificate lifecycle management operations and over development, maintenance andoperation of systems integrity;
BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

(2) selectively testing transactions executed in accordance with disclosed key and certificate
lifecycle management business practices;(3) testing and evaluating the operating effectiveness of the controls; and(4) performing such other procedures as we considered necessary in the circumstances.
We believe that our examination provides a reasonable basis for our opinion.
The relative effectiveness and significance of specific controls at ATS and their effect on
assessments of control risk for subscribers and relying parties are dependent on their interaction
with the controls, and other factors present at individual subscriber and relying party locations.
We have performed no procedures to evaluate the effectiveness of controls at individual
subscriber and relying party locations.
Because of the nature and inherent limitations of controls, ATS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detect andcorrect, error, fraud, unauthorized access to systems and information, or failure to comply withinternal and external policies or requirements. Also, the projection of any conclusions based on
our findings to future periods is subject to the risk that changes may alter the validity of suchconclusions.
In our opinion, throughout the period January 16, 2016 to January 15, 2017, ATS management’sassertion, as referred to above, is fairly stated, in all material respects, based on the Trust ServicePrinciples and Criteria for Certification Authorities, Version 2.0.
This report does not include any representation as to the quality of ATS’ services beyond those
covered by the Trust Service Principles and Criteria for Certification Authorities, Version 2.0, nor
the suitability of any of ATS’ services for any customer's intended purpose.
ATS’ use of the WebTrust for Certification Authorities Seal constitutes a symbolic representationof the contents of this report and it is not intended, nor should it be construed, to update thisreport or provide any additional assurance.

Certified Public Accountants
St. Louis, Missouri
March 28, 20172

Amazon Trust Services LLC Management’s Assertion
March 28, 2017
Amazon Trust Services LLC (“ATS”) operates Certification Authorities (“CAs”) known as Amazon Root CA
1, Amazon Root CA 2, Amazon Root CA 3, Amazon Root CA4, Starfield Services Root Certificate
Authority - G2 and other CAs as listed in Appendix A, and provides the following CA services:•••••••••Subscriber registration
Certificate renewal
Certificate rekey
Certificate issuance
Certificate distribution
Certificate revocation
Certificate validation
Subscriber key generation and management
Subordinate CA certification

The management of ATS is responsible for establishing controls over its CA operations, including its CA
business practices disclosure on its website, CA business practices management, CA environmentalcontrols, CA key lifecycle management controls, subscriber key lifecycle management controls, certificate
lifecycle management controls, and subordinate CA certificate lifecycle management controls. Thesecontrols contain monitoring mechanisms, and actions are taken to correct deficiencies identified.
There are inherent limitations in any controls, including the possibility of human error, and the circumvention
or overriding of controls. Accordingly, even effective controls can only provide reasonable assurance withrespect to ATS’ Certification Authority operations. Furthermore, because of changes in conditions, theeffectiveness of controls may vary over time.
ATS management has assessed its disclosures of its certificate practices and controls over its CA services.
Based on that assessment, in ATS management’s opinion, in providing its CA services in the United Statesof America, throughout the period January 16, 2016 to January 15, 2017, ATS has:•disclosed its business, key lifecycle management, certificate lifecycle management, and CAenvironment control practices in its:o Amazon Trust Services Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5•

maintained effective controls to provide reasonable assurance that:o ATS’ Certification Practice Statement is consistent with its Certificate Policy; ando ATS provides its services in accordance with its Certificate Policy and Certification PracticeStatement•

maintained effective controls to provide reasonable assurance that:o the integrity of keys and certificates it manages is established and protected throughout
their lifecycles;ooo•

the integrity of subscriber keys and certificates it manages is established and protected
throughout their lifecycles;
subscriber information is properly authenticated; andsubordinate CA certificate requests are accurate, authenticated, and approved

maintained effective controls to provide reasonable assurance that:o logical and physical access to CA systems and data is restricted to authorized individuals;o the continuity of key and certificate management operations is maintained; ando CA systems development, maintenance, and operations are properly authorized andperformed to maintain CA systems integrity

based on the Trust Service Principles and Criteria for Certification Authorities, Version 2.0, including thefollowing:
CA Business Practices Disclosure••

Certification Practice Statement (CPS)
Certificate Policy (CP)CA Business Practices Management•••

Certificate Policy Management
Certification Practice Statement Management
CP and CPS Consistency

CA Environmental Controls••••••••••

Security Management
Asset Classification and ManagementPersonnel Security
Physical & Environmental Security
Operations Management
System Access Management
System Development and MaintenanceBusiness Continuity Management
Monitoring and Compliance
Audit Logging

CA Key Lifecycle Management Controls
•••••
•
••

CA Key Generation
CA Key Storage, Backup, and Recovery
CA Public Key Distribution
CA Key Usage
CA Key Archival and Destruction
CA Key Compromise
CA Cryptographic Hardware Lifecycle Management
CA Key Escrow

Subscriber Key Lifecycle Management Controls•

Requirements for Subscriber Key Management

Certificate Lifecycle Management Controls•••••••

Subscriber Registration
Certificate Renewal
Certificate Rekey
Certificate Issuance
Certificate Distribution
Certificate Revocation
Certificate Validation

Subordinate CA Certificate Lifecycle Management Controls•Subordinate CA Certificate Lifecycle Management

ATS did not escrow CA keys, nor did ATS provide Integrated Circuit Card Life Cycle
Management or Certificate Suspension services. ATS only provided Subscriber Key Generationand Subscriber Key Storage and Recovery services when the subscriber was ATS or an affiliate of ATS.
ATS did not delegate subscriber information authentication to any third parties. ATS maintained controls
over subscriber information authentication for all certificates issued.

Jonathan Kozolchyk_____________________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services LLCAPPENDIX A – IN-SCOPE CAs
Root CAs
CN=Amazon Root CA 1,O=Amazon,C=US
CN=Amazon Root CA 2,O=Amazon,C=US
CN=Amazon Root CA 3,O=Amazon,C=US
CN=Amazon Root CA 4,O=Amazon,C=US
CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\,
Inc.,L=Scottsdale,ST=Arizona,C=US
Other CAs
CN=Amazon,OU=Server CA 0A,O=Amazon,C=US
CN=Amazon,OU=Server CA 1A,O=Amazon,C=US
CN=Amazon,OU=Server CA 2A,O=Amazon,C=USCN=Amazon,OU=Server CA 3A,O=Amazon,C=US
CN=Amazon,OU=Server CA 4A,O=Amazon,C=US

SHA-256 Hash of Subject Public
Key Information
fbe3018031f9586bcbf41727e417b7d1

c45c2f47f93be372a17b96b50757d5a2

7f4296fc5b6a4e3b35d3c369623e364ab1af381d8fa7121533c9d6c633ea2461
36abc32656acfc645c61b71613c4bf21
c787f5cabbee48348d58597803d7abc9
f7ecded5c66047d28ed6466b543c40e0743abe81d109254dcf845d4c2c7853c52b071c59a0a0ae76b0eadb2bad23bad4
580b69c3601b630c2eaf0613afa83f92SHA-256 Hash of Subject Public
Key Information
b58539ecaa13921ccdb80d38d34875fd
e6471c5a159d9beef2fa6f99983bd611
64bb5bd80311fa3f53bd99404cab8762
ad6e048447d0a97f219fceca1661f37c

1bda5afff83781380bf708198f9f7d2db1e067f14bb9ea7bae70aac0b0305e7b
7c53b5df79135d9af6195ef6bb73ab98
c2c89950b892b192dffd784db925a41c
17708dff2b7faec9cb1b5215ebb2421d97b0543c936fac9d6e02b92f20e5c707

Notes: Amazon Trust Services assumed operation of Starfield Services Root Certificate Authority - G2 (SFSG2) on June 10, 2015.
Starfield Technologies operated SFSG2 prior to June 10, 2015 and was responsible for the key generation for SFSG2.