Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 S Hanley Rd, #800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
Scope
We have examined ATS management’s assertion that for its Certification Authority (“CA”)
operations in Washington and Virginia, in the United States of America, for its CAs as enumerated
in Attachment B, ATS has:•disclosed its business, key lifecycle management, certificate lifecycle management, andCA environment control practices in the applicable versions of its Amazon Trust Services
Certification Practice Statement (“CPS”) and Amazon Trust Services Certificate Policy(“CP”) enumerated in Attachment A•

maintained effective controls to provide reasonable assurance that:o ATS’ CPS is consistent with its CP; ando ATS provides its services in accordance with its CP and CPS•

maintained effective controls to provide reasonable assurance that:o the integrity of keys and certificates it manages is established and protected
throughout their lifecycles;o the integrity of subscriber keys and certificates it manages is established andprotected throughout their lifecycles;
o subscriber information is properly authenticated; ando subordinate CA certificate requests are accurate, authenticated, and approved•

maintained effective controls to provide reasonable assurance that:o logical and physical access to CA systems and data is restricted to authorizedindividuals;o the continuity of key and certificate management operations is maintained; ando CA systems development, maintenance, and operations are properly authorized
and performed to maintain CA systems integrity

throughout the period January 16, 2021 to January 15, 2022, based on the WebTrust Principles
and Criteria for Certification Authorities v2.2.1.
ATS does not escrow CA keys, does not provide certificate suspension services, and does notprovide the subscriber key lifecycle management services. Accordingly, our examination did notextend to controls that would address those criteria.
Certification Authority’s Responsibilities
ATS’ management is responsible for its assertion, including the fairness of its presentation, andthe provision of its described services in accordance with the WebTrust Principles and Criteria for
Certification Authorities v2.2.1.

BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

Independent Accountant’s Responsibilities
Our responsibility is to express an opinion on ATS management’s assertion based on our
examination. Our examination was conducted in accordance with attestation standards
established by the American Institute of Certified Public Accountants. Those standards requirethat we plan and perform the examination to obtain reasonable assurance about whether
management’s assertion is fairly stated, in all material respects. An examination involves
performing procedures to obtain evidence about management’s assertion. The nature, timing,and extent of the procedures selected depend on our judgment, including an assessment of therisks of material misstatement of management’s assertion, whether due to fraud or error. We
believe that the evidence we obtained is sufficient and appropriate to provide a reasonable basis
for our opinion.
We are required to be independent and to meet our other ethical responsibilities in accordancewith relevant ethical requirements relating to the engagement.
The relative effectiveness and significance of specific controls at ATS and their effect on
assessments of control risk for subscribers and relying parties are dependent on their interaction
with the controls, and other factors present at individual subscriber and relying party locations.
Our examination did not extend to controls at individual subscriber and relying party locations
and we have not evaluated the effectiveness of such controls.
Inherent limitations
There are inherent limitations in the effectiveness of any system of internal control, including
the possibility of human error and the circumvention of controls. For example, because of theirnature, controls may not prevent, or detect unauthorized access to systems and information, or
failure to comply with internal and external policies or requirements. Also, the projection to the
future of any conclusions based on our findings is subject to the risk that controls may become
ineffective.
Independent Accountant’s Opinion
In our opinion management’s assertion, as referred to above, is fairly stated, in all material
respects.
This report does not include any representation as to the quality of ATS’ services other than its
CA operations in various locations in the United States of America, nor the suitability of any ofATS’ services for any customer's intended purpose.
Other Matter
Without modifying our opinion, we noted the following other matters during our procedures:2Matter Topic

Matter Description

1

Certificate Validation

Amazon Trust Services disclosed in Mozilla Bug #1713978
that its CP included the deprecated domain validation
Method 3.2.2.4.6.

2

Certificate Revocation

Amazon Trust Services disclosed in Mozilla Bug #1713976
that neither its CP nor its CPS specifies the methods
parties may use to demonstrate key compromise.

3

Subject Registration

Amazon Trust Services disclosed in Mozilla Bug #1746945
that it did not perform the CAA records check for its
test website certificates.

4

CA Certificate Content

Amazon Trust Services disclosed in Mozilla Bug #1743935
that it had misissued CA certificates per its CP and CPS
policy.
Amazon Trust Services disclosed in Mozilla Bug #1743943
that revocation of one of the misissued CA certificates
was delayed beyond the required timeline.

While the ATS assertion notes all issues disclosed on Bugzilla during the engagement period, we
have only noted those instances relevant to the CAs enumerated in Attachment B and applicableto the WebTrust Principles and Criteria for Certification Authorities v2.2.1.
Use of the WebTrust Seal
ATS’ use of the WebTrust for Certification Authorities Seal constitutes a symbolic representationof the contents of this report and it is not intended, nor should it be construed, to update thisreport or provide any additional assurance.

April 8, 2022

3

ATTACHMENT A – CERTIFICATION PRACTICE STATEMENT AND CERTIFICATEPOLICY VERSIONS IN-SCOPE
Policy Name
Amazon Trust Services Certificate Policy

Version
1.0.11

Effective Date
August 18, 2021

Amazon Trust Services Certificate Policy

1.0.10July 23, 2021

Amazon Trust Services Certificate Policy

1.0.9

April 23, 2021

Amazon Trust Services Certificate Policy

1.0.8

March 30, 2020

Amazon Trust Services Certification Practice Statement

1.0.12

August 18, 2021

Amazon Trust Services Certification Practice Statement

1.0.11

July 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.10April 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.9

March 30, 2020

4

ATTACHMENT B – IN-SCOPE CAs
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

Valid To

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 1
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint

87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

SPKI SHA256

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

CN = Amazon Root CA 2
O = Amazon
C = US
1

Valid From

CN = Amazon Root CA 1
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

Valid From

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

5/25/201512/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

5

Cross-Signed Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

Valid From

Valid To

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/201512/31/2037

CN = Amazon Root CA 4
O = Amazon
C = US

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/201512/31/2037

Intermediate CAs
Subject DN
CN = Amazon
OU = Server CA 0A
O = Amazon
C = US
CN = Amazon
OU = Server CA 1A
O = Amazon
C = US
CN = Amazon
OU = Server CA 2A
O = Amazon
C = US
CN = Amazon
OU = Server CA 3A
O = Amazon
C = US
CN = Amazon
OU = Server CA 4A
O = Amazon
C = USSHA2 Thumbprint

SPKI SHA256

Valid From

Valid To

DFCC775C644DB4A33AD71293433F463C8E31057CE22CB267F9D31A0353F4FC2F

B58539ECAA13921CCDB80
D38D34875FDE6471C5A159
D9BEEF2FA6F99983BD611

10/21/2015

10/18/2025

39C763A9CF19D923F977D23626AB890449A444AB8B795C815EF1EF81FEBC1E38

64BB5BD80311FA3F53BD99
404CAB8762AD6E048447D0
A97F219FCECA1661F37C

10/21/2015

10/18/2025

72130E3B28900349214617F4D6F3FB85D08475EE78BF095C59458A14D1828866

1BDA5AFFF83781380BF708
198F9F7D2DB1E067F14BB9
EA7BAE70AAC0B0305E7B

10/21/2015

10/18/2025

205154B777EDC55A5146585A5E54E054A70BE4AAD3B85D02318DA27BF807ADF1

7C53B5DF79135D9AF6195E
F6BB73AB98C2C89950B892
B192DFFD784DB925A41C

10/21/2015

10/18/2025

7BED29276ACBED9F176F38BBA3A67CE5815B5CBF1522C7BB59ECD86B09E16ED2

17708DFF2B7FAEC9CB1B52
15EBB2421D97B0543C936F
AC9D6E02B92F20E5C707

10/21/2015

10/18/2025

6

AMAZON TRUST SERVICES, LLC MANAGEMENT’S ASSERTION
Amazon Trust Services, LLC (“ATS”) operates the Certification Authority (“CA”) services for theCAs enumerated in Attachment B, and provides the following CA services:
•
•
•
•
•
•
•
•

Subscriber registration
Certificate renewal
Certificate rekey
Certificate issuance
Certificate distribution
Certificate revocation
Certificate validation
Subordinate CA and cross-certification

The management of ATS is responsible for establishing and maintaining effective controls over its
CA operations, including its CA business practices disclosure on its repository, CA businesspractices management, CA environmental controls, CA key lifecycle management controls,
certificate lifecycle management controls, and subordinate CA certificate lifecycle management
controls. These controls contain monitoring mechanisms, and actions are taken to correct
deficiencies identified.
There are inherent limitations in any controls, including the possibility of human error, and thecircumvention or overriding of controls. Accordingly, even effective controls can only provide
reasonable assurance with respect to ATS’ CA operations. Furthermore, because of changes in
conditions, the effectiveness of controls may vary over time.
ATS management has assessed its disclosures of its certificate practices and controls over its CA
services. Based on that assessment, in ATS management’s opinion, in providing its CA services in
Washington and Virginia, in the United States of America, ATS has:•disclosed its business, key lifecycle management, certificate lifecycle management, andCA environment control practices in the applicable versions of its Amazon Trust Services
Certification Practice Statement (“CPS”) and Amazon Trust Services Certificate Policy(“CP”) enumerated in Attachment A•

maintained effective controls to provide reasonable assurance that:o ATS’ CPS is consistent with its CP; ando ATS provides its services in accordance with its CP and CPS•

maintained effective controls to provide reasonable assurance that:o the integrity of keys and certificates it manages is established and protected
throughout their lifecycles;o the integrity of subscriber keys and certificates it manages is established andprotected throughout their lifecycles;
o subscriber information is properly authenticated; ando subordinate CA certificate requests are accurate, authenticated, and approved•maintained effective controls to provide reasonable assurance that:o logical and physical access to CA systems and data is restricted to authorizedindividuals;o the continuity of key and certificate management operations is maintained; ando CA systems development, maintenance, and operations are properly authorized
and performed to maintain CA systems integrity

throughout the period January 16, 2021 to January 15, 2022, based on the WebTrust Principles
and Criteria for Certification Authorities v2.2.1, including the following:
CA Business Practices Disclosure••

Certification Practice Statement (CPS)
Certificate Policy (CP)CA Business Practices Management•••

Certification Practice Statement (CPS) Management
Certificate Policy (CP) Management
CP and CPS Consistency

CA Environmental Controls
•
•
•
•
•
•
•
•
•
•

Security Management
Asset Classification and Management
Personnel Security
Physical and Environmental Security
Operations Management
System Access Management
System Development, Maintenance, and Change Management
Disaster Recovery, Backups, and Business Continuity Management
Monitoring and Compliance
Audit Logging

CA Key Lifecycle Management Controls
•
•
•
•
•
•
•
•
•
•

CA Key Generation
CA Key Storage, Backup, and Recovery
CA Public Key Distribution
CA Key Usage
CA Key Archival
CA Key Destruction
CA Key Compromise
CA Cryptographic Hardware Life Cycle Management
CA Key Transportation
CA Key Migration

Certificate Lifecycle Management Controls
•
•
•
•
•
•
•

Subscriber Registration
Certificate Renewal
Certificate Rekey
Certificate Issuance
Certificate Distribution
Certificate Revocation
Certificate Validation

Subordinate CA and Cross Certificate Lifecycle Management Controls•

Subordinate CA Certificate and Cross Certificate Lifecycle Management

ATS does not escrow CA keys, does not provide certificate suspension services, and does notprovide subscriber key lifecycle management services. Accordingly, our assertion does not extend
to controls that would address those criteria.
ATS did not delegate subscriber information authentication to any third parties. ATS maintained
controls over subscriber information authentication for all certificates issued.
ATS has disclosed the following matters publicly on Mozilla’s Bugzilla platform:
Bug ID
1713668
17139781713976
17199201743943
1743935
1746945

Summary
Amazon Trust Services: ALV Errors
Amazon Trust Services: Forbidden
Domain Validation Method 3.2.2.4.6
Amazon Trust Services: CP/CPS does
not specify key compromise methods
Amazon Trust Services: Revocation
Time for Intermediate CertificatesAmazon Trust Services - Delayed
Revocation of Subordinate CA
Amazon Trust Services - Misissuanceof Subordinate Per CPS
Amazon Trust Services - Missing CAA
Check For Test Website Certificates

Jonathan Kozolchyk

Opened5/31/2021

Closed7/30/2021

Resolution
Fixed

6/1/2021

7/30/2021

Fixed

6/1/2021

9/7/2021

Fixed

7/9/2021

9/7/2021

Fixed

12/1/2021

Open as ofReport Date---

12/1/2021

12/22/2021

Fixed

12/20/2021

1/14/2022

Fixed_____________________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services LLC
April 8, 2022

ATTACHMENT A – CERTIFICATION PRACTICE STATEMENT AND CERTIFICATEPOLICY VERSIONS IN-SCOPE
Policy Name
Amazon Trust Services Certificate Policy

Version
1.0.11

Effective Date
August 18, 2021

Amazon Trust Services Certificate Policy

1.0.10July 23, 2021

Amazon Trust Services Certificate Policy

1.0.9

April 23, 2021

Amazon Trust Services Certificate Policy

1.0.8

March 30, 2020

Amazon Trust Services Certification Practice Statement

1.0.12

August 18, 2021

Amazon Trust Services Certification Practice Statement

1.0.11

July 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.10April 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.9

March 30, 2020

ATTACHMENT B – IN-SCOPE CAs
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

Valid To

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 1
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint

87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

SPKI SHA256

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

1

Valid From

CN = Amazon Root CA 1
O = Amazon
C = US

Valid From

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/201512/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 4
O = Amazon
C = USIntermediate CAs
Subject DN
CN = Amazon
OU = Server CA 0A
O = Amazon
C = US
CN = Amazon
OU = Server CA 1A
O = Amazon
C = US
CN = Amazon
OU = Server CA 2A
O = Amazon
C = US
CN = Amazon
OU = Server CA 3A
O = Amazon
C = US
CN = Amazon
OU = Server CA 4A
O = Amazon
C = USSHA2 Thumbprint

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

SHA2 Thumbprint

SPKI SHA256

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5SPKI SHA256

Valid From

5/25/2015

Valid From

Valid To

12/31/2037

Valid To

DFCC775C644DB4A33AD71293433F463C8E31057CE22CB267F9D31A0353F4FC2F

B58539ECAA13921CCDB80
D38D34875FDE6471C5A159
D9BEEF2FA6F99983BD611

10/21/2015

10/18/2025

39C763A9CF19D923F977D23626AB890449A444AB8B795C815EF1EF81FEBC1E38

64BB5BD80311FA3F53BD99
404CAB8762AD6E048447D0
A97F219FCECA1661F37C

10/21/2015

10/18/2025

72130E3B28900349214617F4D6F3FB85D08475EE78BF095C59458A14D1828866

1BDA5AFFF83781380BF708
198F9F7D2DB1E067F14BB9
EA7BAE70AAC0B0305E7B

10/21/2015

10/18/2025

205154B777EDC55A5146585A5E54E054A70BE4AAD3B85D02318DA27BF807ADF1

7C53B5DF79135D9AF6195E
F6BB73AB98C2C89950B892
B192DFFD784DB925A41C

10/21/2015

10/18/2025

7BED29276ACBED9F176F38BBA3A67CE5815B5CBF1522C7BB59ECD86B09E16ED2

17708DFF2B7FAEC9CB1B52
15EBB2421D97B0543C936F
AC9D6E02B92F20E5C707

10/21/2015

10/18/2025