Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 S Hanley Rd, #800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
We have examined ATS management’s assertion that for its Certification Authority (“CA”)
operations in the United States of America, throughout the period January 16, 2016 to January
15, 2017 for its root CAs known as Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3,
Amazon Root CA 4, Starfield Services Root Certificate Authority - G2 and other CAs listed inAppendix A in scope for SSL Baseline Requirements and Network Security Requirements ATS has:x

disclosed its SSL certificate lifecycle management business practices in its:o Amazon Trust Services Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5,
including its commitment to provide SSL certificates in conformity with the CA/Browser
Forum Requirements on the ATS website, and provided such services in accordance withits disclosed practicesxmaintained effective controls to provide reasonable assurance that:o the integrity of keys and SSL certificates it manages is established and protectedthroughout their lifecycles; ando SSL subscriber information is properly authenticatedxmaintained effective controls to provide reasonable assurance that:o logical and physical access to CA systems and data is restricted to authorizedindividuals;o the continuity of key and certificate management operations is maintained; ando CA systems development, maintenance, and operations are properly authorized
and performed to maintain CA systems integrityxmaintained effective controls to provide reasonable assurance that it meets the Networkand Certificate System Security Requirements as set forth by the CA/Browser Forumbased on the WebTrust Principles and Criteria for Certification Authorities – SSL Baseline withNetwork Security, Version 2.0.
ATS’ management is responsible for its assertion. Our responsibility is to express an opinion on
management’s assertion based on our examination.
We conducted our examination in accordance with standards for attestation engagements
established by the American Institute of Certified Public Accountants and, accordingly, included:

BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

(1) obtaining an understanding of ATS’ SSL certificate lifecycle management businesspractices, including its relevant controls over the issuance, renewal, and revocation of
SSL certificates, and obtaining an understanding of ATS’ network and certificate systemsecurity to meet the requirements set forth by the CA/Browser Forum;(2) selectively testing transactions executed in accordance with disclosed SSL certificate
lifecycle management practices;(3) testing and evaluating the operating effectiveness of the controls; and(4) performing such other procedures as we considered necessary in the circumstances.
We believe that our examination provides a reasonable basis for our opinion.
The relative effectiveness and significance of specific controls at ATS and their effect on
assessments of control risk for subscribers and relying parties are dependent on their interaction
with the controls, and other factors present at individual subscriber and relying party locations.
We have performed no procedures to evaluate the effectiveness of controls at individual
subscriber and relying party locations.
Because of the nature and inherent limitations of controls, ATS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detect andcorrect, error, fraud, unauthorized access to systems and information, or failure to comply withinternal and external policies or requirements. Also, the projection of any conclusions based on
our findings to future periods is subject to the risk that changes may alter the validity of suchconclusions.
In our opinion, throughout the period January 16, 2016 to January 15, 2017, ATS management’sassertion, as referred to above, is fairly stated, in all material respects, based on the WebTrust
Principles and Criteria for Certification Authorities – SSL Baseline with Network Security, Version2.0.
This report does not include any representation as to the quality of ATS’ services beyond those
covered by the WebTrust Principles and Criteria for Certification Authorities – SSL Baseline withNetwork Security, Version 2.0, nor the suitability of any of ATS’ services for any customer’s
intended purpose.
ATS’ use of the WebTrust for Certification Authorities – SSL Baseline with Network Security Sealconstitutes a symbolic representation of the contents of this report and it is not intended, norshould it be construed, to update this report or provide any additional assurance.

Certified Public Accountants
St. Louis, Missouri
March 28, 20172

Amazon Trust Services LLC Management’s Assertion
March 28, 2017
Amazon Trust Services LLC (“ATS”) operates the Certification Authorities (“CAs”) known as Amazon
Root CA 1, Amazon Root CA 2, Amazon Root CA 3, Amazon Root CA4, Starfield Services Root
Certificate Authority - G2 and other CAs as listed in Appendix A in scope for SSL Baseline
Requirements and Network Security Requirements and provides SSL CA services.
The management of ATS is responsible for establishing and maintaining effective controls over its
SSL CA operations, including its network and certificate security system controls, its SSL CA
business practices disclosure on its website, SSL key lifecycle management controls, and SSL
certificate lifecycle management controls. These controls contain monitoring mechanisms, andactions are taken to correct deficiencies identified.
There are inherent limitations in any controls, including the possibility of human error, and thecircumvention or overriding of controls. Accordingly, even effective controls can only provide
reasonable assurance with respect to ATS’ Certification Authority operations. Furthermore, becauseof changes in conditions, the effectiveness of controls may vary over time.
ATS management has assessed its disclosures of its certificate practices and controls over its SSL
CA services. Based on that assessment, in ATS management’s opinion, in providing its SSL CA
services in the United States of America, throughout the period January 16, 2016 to January 15,
2017, ATS has:•disclosed its SSL certificate lifecycle management business practices in its:o Amazon Trust Services Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5,including its commitment to provide SSL certificates in conformity with the CA/Browser
Forum Requirements on the ATS website, and provided such services in accordance withits disclosed practices•

maintained effective controls to provide reasonable assurance that:o the integrity of keys and SSL certificates it manages is established and protected
throughout their lifecycles; ando SSL subscriber information is properly authenticated•maintained effective controls to provide reasonable assurance that:o logical and physical access to CA systems and data is restricted to authorizedindividuals;o the continuity of key and certificate management operations is maintained; ando CA systems development, maintenance, and operations are properly authorized andperformed to maintain CA systems integrity•maintained effective controls to provide reasonable assurance that it meets the Network andCertificate System Security Requirements as set forth by the CA/Browser Forumbased on the WebTrust Principles and Criteria for Certification Authorities – SSL Baseline withNetwork Security, Version 2.0.

Jonathan Kozolchyk_____________________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services LLCAPPENDIX A – IN-SCOPE CAs
Root CAs
CN=Amazon Root CA 1,O=Amazon,C=US
CN=Amazon Root CA 2,O=Amazon,C=US
CN=Amazon Root CA 3,O=Amazon,C=US
CN=Amazon Root CA 4,O=Amazon,C=US

SHA-256 Hash of Subject Public
Key Information
fbe3018031f9586bcbf41727e417b7d1

c45c2f47f93be372a17b96b50757d5a2

7f4296fc5b6a4e3b35d3c369623e364ab1af381d8fa7121533c9d6c633ea2461
36abc32656acfc645c61b71613c4bf21
c787f5cabbee48348d58597803d7abc9
f7ecded5c66047d28ed6466b543c40e0743abe81d109254dcf845d4c2c7853c5
2b071c59a0a0ae76b0eadb2bad23bad4
580b69c3601b630c2eaf0613afa83f92

Other CAs

SHA-256 Hash of Subject Public
Key Information

CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\,
Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Amazon,OU=Server CA 0A,O=Amazon,C=US
CN=Amazon,OU=Server CA 1A,O=Amazon,C=US

1bda5afff83781380bf708198f9f7d2db1e067f14bb9ea7bae70aac0b0305e7b7c53b5df79135d9af6195ef6bb73ab98
c2c89950b892b192dffd784db925a41c
17708dff2b7faec9cb1b5215ebb2421db58539ecaa13921ccdb80d38d34875fd
e6471c5a159d9beef2fa6f99983bd611
64bb5bd80311fa3f53bd99404cab8762
ad6e048447d0a97f219fceca1661f37c

CN=Amazon,OU=Server CA 2A,O=Amazon,C=US
CN=Amazon,OU=Server CA 3A,O=Amazon,C=US
CN=Amazon,OU=Server CA 4A,O=Amazon,C=US

97b0543c936fac9d6e02b92f20e5c707

Notes: Amazon Trust Services assumed operation of Starfield Services Root Certificate Authority - G2 (SFSG2) on June 10, 2015.
Starfield Technologies operated SFSG2 prior to June 10, 2015 and was responsible for the key generation for SFSG2.