Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 S Hanley Rd, #800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
Scope
We have examined ATS management’s assertion that for its Certification Authority (“CA”)
operations in Washington and Virginia, in the United States of America, throughout the period
January 16, 2020 to January 15, 2021 for its CAs as enumerated in Attachment B, ATS has:•disclosed its extended validation code signing (“EV CS”) certificate lifecycle managementbusiness practices in the applicable versions of its Amazon Trust Services Certificate
Practice Statement (“CPS”) and Amazon Trust Services Certificate Policy (“CP”)
enumerated in Attachment A, including its commitment to provide EV CS certificates inconformity with the CA/Browser Forum Guidelines on the ATS repository, and provided
such services in accordance with its disclosed practices•

maintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

throughout the period January 16, 2020 to January 15, 2021, based on the WebTrust Principles
and Criteria for Certification Authorities – Extended Validation Code Signing v1.4.1.
Certification Authority’s Responsibilities
ATS’ management is responsible for its assertion, including the fairness of its presentation, andthe provision of its described services in accordance the WebTrust Principles and Criteria for
Certification Authorities – Extended Validation Code Signing v1.4.1.
Independent Accountant’s Responsibilities
Our examination was conducted in accordance with attestation standards established by theAmerican Institute of Certified Public Accountants. Those standards require that we plan andperform the examination to obtain reasonable assurance about whether management’s assertionis fairly stated, in all material respects. An examination involves performing procedures to obtainevidence about management’s assertion. The nature, timing, and extent of the procedures
selected depend on our judgment, including an assessment of the risks of material misstatementof management’s assertion, whether due to fraud or error. We believe that the evidence weobtained is sufficient and appropriate to provide a reasonable basis for our opinion.
The relative effectiveness and significance of specific controls at ATS and their effect onassessments of control risk for subscribers and relying parties are dependent on their interaction
with the controls and other factors present at individual subscriber and relying party locations.

BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

Our examination did not extend to controls at individual subscriber and relying party locations
and we have not evaluated the effectiveness of such controls.
Inherent Limitations
Because of the nature and inherent limitations of controls, ATS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detect andcorrect, error, fraud, unauthorized access to systems and information, or failure to comply withinternal and external policies or requirements. Also, the projection of any conclusions based on
our findings to future periods is subject to the risk that changes may alter the validity of suchconclusions.
Independent Accountant’s Opinion
In our opinion management’s assertion, as referred to above, is fairly stated, in all materialrespects.
During the examination period, ATS did not issue any EV CS subscriber certificates.
This report does not include any representation as to the quality of ATS’ services other than its
CA services in various locations in the United States of America, nor the suitability of any of ATS’services for any customer's intended purpose.
Other Matters
The World Health Organization classified the COVID-19 outbreak as a pandemic in March 2020.
Based on the rapid increase in exposure globally, the gravity or length of the impact of theCOVID-19 outbreak cannot be determined at this time.
Use of the WebTrust Seal
ATS’ use of the WebTrust for Certification Authorities – Extended Validation Code Signing Seal
constitutes a symbolic representation of the contents of this report and it is not intended, norshould it be construed, to update this report or provide any additional assurance.

April 12, 2021

ATTACHMENT A – CERTIFICATION PRACTICE STATEMENT AND CERTIFICATEPOLICY VERSIONS IN-SCOPE
Policy Name
Amazon Trust Services Certification Practice Statement

Version
1.0.9

Effective Date
March 30, 2020

Amazon Trust Services Certification Practice Statement

1.0.8

December 17, 2019

Amazon Trust Services Certificate Policy

1.0.8

March 30, 2020

Amazon Trust Services Certificate Policy

1.0.7

December 18, 2019

ATTACHMENT B – IN-SCOPE CAs
Root CAs
Subject DN

SHA2 Thumbprint

Valid From

Valid To

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB47F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A436ABC32656ACFC645C61B71613C4BF21C787F5CABBEE
48348D58597803D7ABC95/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D109254DCF845D4C2C7853C55/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 1
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint

87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

1

SPKI SHA256

CN = Amazon Root CA 1
O = Amazon
C = USSPKI SHA256

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

Valid From

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

Cross-Signed Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

Valid FromValid To

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F07F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE
48348D58597803D7ABC95/25/2015

12/31/2037

CN = Amazon Root CA 4
O = Amazon
C = US

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D109254DCF845D4C2C7853C55/25/2015

12/31/2037

CC OTH 00147919 2021 TRAMAZON TRUST SERVICES, LLC MANAGEMENT’S ASSERTION
Amazon Trust Services, LLC (“ATS”) operates the Certification Authority (“CA”) services for theCAs enumerated in Attachment B, and provides Extended Validation Code Signing (“EV CS”) CAservices.
The management of ATS is responsible for establishing and maintaining effective controls over its
EV CS CA operations, including its EV CS CA business practices disclosure on its repository, EV CS
key lifecycle management controls, and EV CS certificate lifecycle management controls. Thesecontrols contain monitoring mechanisms, and actions are taken to correct deficiencies identified.
There are inherent limitations in any controls, including the possibility of human error, and thecircumvention or overriding of controls. Accordingly, even effective controls can only provide
reasonable assurance with respect to ATS’ CA operations. Furthermore, because of changes inconditions, the effectiveness of controls may vary of time.
ATS management has assessed its disclosures of its certificate practices and controls over its EV
CS CA services. Based on that assessment, in ATS management’s opinion, in providing its EV CS
CA services in Washington and Virginia, in the United States of America, throughout the period
January 16, 2020 to January 15, 2021, ATS has:disclosed its EV CS certificate lifecycle management business practices in the applicableversions of its Amazon Trust Services Certificate Practice Statement (“CPS”) and Amazon
Trust Services Certificate Policy (“CP”) enumerated in Attachment A, including itscommitment to provide EV CS certificates in conformity with the CA/Browser Forum
Requirements on the ATS repository, and provided such services in accordance with its
disclosed practicesmaintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

throughout the period January 16, 2020 to January 15, 2021, based on the WebTrust Principles
and Criteria for Certification Authorities – Extended Validation Code Signing, Version 1.4.1.
During the examination period, ATS did not issue any Extended Validation Code Signing subscriber
certificates.

_____________________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services, LLC
April 12, 2021

CC OTH 00147919 2021 TR

ATTACHMENT A – CERTIFICATION PRACTICE STATEMENT AND CERTIFICATEPOLICY VERSIONS IN-SCOPE
Policy Name

Version

Effective Date

Amazon Trust Services Certification Practice Statement

1.0.9

March 30, 2020

Amazon Trust Services Certification Practice Statement

1.0.8

December 17, 2019

Amazon Trust Services Certificate Policy

1.0.8

March 30, 2020

Amazon Trust Services Certificate Policy

1.0.7

December 18, 2019CC OTH 00147919 2021 TR

ATTACHMENT B – IN-SCOPE CAs
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

CN = Amazon Root CA 1
O = Amazon
C = US

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A25/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB47F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A436ABC32656ACFC645C61B71613C4BF21C787F5CABBEE
48348D58597803D7ABC95/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C55/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G21
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint

SPKI SHA256

87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

1Valid From

Valid From

Valid To

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F07F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B71613C4BF21C787F5CABBEE
48348D58597803D7ABC95/25/2015

12/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

CC OTH 00147919 2021 TR

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 4
O = Amazon
C = USSHA2 Thumbprint

SPKI SHA256

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

F7ECDED5C66047D28ED6466B543C40E0743ABE81D109254DCF845D4C2C7853C5Valid From
5/25/2015

Valid To
12/31/2037