Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 South Hanley Road, Suite 800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
We have examined ATS management’s assertion that for its Certification Authority (“CA”)
operations in the United States of America, throughout the period January 16, 2016 to January
15, 2017 for its root CAs known as Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3,
Amazon Root CA 4, Starfield Services Root Certificate Authority - G2 and other CAs listed inAppendix A, ATS has:
xdisclosed its extended validation SSL (“EV SSL”) certificate lifecycle management businesspractices in its:o Amazon Trust Services Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5,
including its commitment to provide EV SSL certificates in conformity with the CA/Browser
Forum Guidelines on the ATS website, and provided such services in accordance with its
disclosed practicesxmaintained effective controls to provide reasonable assurance that:o the integrity of keys and EV SSL certificates it manages is established andprotected throughout their lifecycles; ando EV SSL subscriber information is properly authenticated for the registration
activities performed by ATS

based on the WebTrust Principles and Criteria for Certification Authorities – Extended Validation
SSL Version 1.4.5.
ATS’ management is responsible for its assertion. Our responsibility is to express an opinion on
management’s assertion based on our examination.
We conducted our examination in accordance with standards for attestation engagements
established by the American Institute of Certified Public Accountants and, accordingly, included:(1) obtaining an understanding of ATS’ EV SSL certificate lifecycle management businesspractices, including its relevant controls over the issuance, renewal, and revocation of EV
SSL certificates;(2) selectively testing transactions executed in accordance with disclosed EV SSL certificate
lifecycle management practices;(3) testing and evaluating the operating effectiveness of the controls; and(4) performing such other procedures as we considered necessary in the circumstances.
We believe that our examination provides a reasonable basis for our opinion.
The relative effectiveness and significance of controls at ATS and their effect on assessments ofcontrol risk for subscribers and relying parties are dependent on their interaction with thecontrols, and other factors present at individual subscriber and relying party locations. We have
BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

performed no procedures to evaluate the effectiveness of controls at individual subscriber andrelying party locations.
Because of the nature and inherent limitations of controls, ATS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detect andcorrect, error, fraud, unauthorized access to systems and information, or failure to comply withinternal and external policies or requirements. Also, the projection of any conclusions based on
our findings to future periods is subject to the risk that changes may alter the validity of suchconclusions.
In our opinion, throughout the period January 16, 2016 to January 15, 2017, ATS management’s
assertion, as referred to above, is fairly stated, in all material respects, based on the WebTrust
Principles and Criteria for Certification Authorities – Extended Validation SSL Version 1.4.5.
This report does not include any representation as to the quality of ATS’ services beyond those
covered by the WebTrust Principles and Criteria for Certification Authorities – Extended Validation
SSL Version 1.4.5, nor the suitability of any of ATS’ services for any customer's intended purpose.
ATS’ use of the WebTrust for Certification Authorities – Extended Validation SSL Seal constitutes
a symbolic representation of the contents of this report and it is not intended, nor should it beconstrued, to update this report or provide any additional assurance.

Certified Public Accountants
St. Louis, Missouri
March 28, 20172

Amazon Trust Services LLC Management’s Assertion
March 28, 2017
Amazon Trust Services LLC Certification Authority (“ATS”) operates the Certification Authorities (“CAs”)
known as Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3, Amazon Root CA4, Starfield
Services Root Certificate Authority - G2 and other CAs as listed in Appendix A, and provides ExtendedValidation SSL (“EV SSL”) CA services.
The management of ATS is responsible for establishing and maintaining effective controls over its EV SSL
CA operations, including its EV SSL CA business practices disclosure on its website, EV SSL key lifecycle
management controls, and EV SSL certificate lifecycle management controls. These controls containmonitoring mechanisms, and actions are taken to correct deficiencies identified.
There are inherent limitations in any controls, including the possibility of human error, and the circumvention
or overriding of controls. Accordingly, even effective controls can only provide reasonable assurance withrespect to ATS’ Certification Authority operations. Furthermore, because of changes in conditions, theeffectiveness of controls may vary over time.
ATS management has assessed its disclosures of its certificate practices and controls over its EV SSL CAservices. Based on that assessment, in ATS management’s opinion, in providing its EV SSL CA services
in the United States of America, throughout the period January 16, 2016 to January 15, 2017, ATS has:•disclosed its extended validation SSL (“EV SSL”) certificate lifecycle management businesspractices in its:
- Amazon Trust Services Certificate Policy v1.0.4; and- Amazon Trust Services Certification Practice Statement v1.0.5,
including its commitment to provide EV SSL certificates in conformity with the CA/Browser Forum
Requirements on the ATS website, and provided such services in accordance with its disclosed
practices•maintained effective controls to provide reasonable assurance that:o the integrity of keys and EV SSL certificates it manages is established and protected
throughout their lifecycles; ando EV SSL subscriber information is properly authenticated for the registration activities
performed by ATS

based on the WebTrust Principles and Criteria for Certification Authorities – Extended Validation SSL,Version 1.4.5.

Jonathan Kozolchyk_____________________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services LLC

CN=Amazon,OU=Server CA 3A,O=Amazon,C=US

CN=Amazon,OU=Server CA 2A,O=Amazon,C=US

CN=Amazon,OU=Server CA 1A,O=Amazon,C=US

CN=Amazon,OU=Server CA 0A,O=Amazon,C=US

Other CAs

CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\,
Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Amazon Root CA 4,O=Amazon,C=US

CN=Amazon Root CA 3,O=Amazon,C=US

CN=Amazon Root CA 2,O=Amazon,C=US

CN=Amazon Root CA 1,O=Amazon,C=US

Root CAs

17708dff2b7faec9cb1b5215ebb2421d97b0543c936fac9d6e02b92f20e5c707

7c53b5df79135d9af6195ef6bb73ab98c2c89950b
892b192dffd784db925a41c

1bda5afff83781380bf708198f9f7d2db1e067f14
bb9ea7bae70aac0b0305e7b64bb5bd80311fa3f53bd99404cab8762
ad6e048447d0a97f219fceca1661f37cb58539ecaa13921ccdb80d38d34875fde6471c5a1
59d9beef2fa6f99983bd611

SHA-256 Hash of Subject Public
Key Information

2b071c59a0a0ae76b0eadb2bad23bad4580b69c36
01b630c2eaf0613afa83f92

f7ecded5c66047d28ed6466b543c40e0743abe81d109254dcf845d4c2c7853c5

36abc32656acfc645c61b71613c4bf21c787f5cab
bee48348d58597803d7abc9

7f4296fc5b6a4e3b35d3c369623e364ab1af381d8
fa7121533c9d6c633ea2461

fbe3018031f9586bcbf41727e417b7d1c45c2f47f
93be372a17b96b50757d5a2

SHA-256 Hash of Subject Public
Key Information

APPENDIX A – IN-SCOPE CAs

CN=Amazon,OU=Server CA 4A,O=Amazon,C=US

Notes: Amazon Trust Services assumed operation of Starfield Services Root Certificate Authority - G2 (SFSG2) on June 10, 2015.
Starfield Technologies operated SFSG2 prior to June 10, 2015 and was responsible for the key generation for SFSG2.