Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 South Hanley Road, Suite 800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
We have examined ATS management’s assertion that for its Certification Authority (“CA”)
operations at in the United States of America, throughout the period January 16, 2016 to January
15, 2017 for its root CAs known as Amazon Root CA 1, Amazon Root CA 2, Amazon Root CA 3,Amazon Root CA 4, Starfield Services Root Certificate Authority - G2 as listed in Appendix A, ATShas:•disclosed its extended validation code signing (“EV CS”) certificate lifecycle managementbusiness practices in its:o Amazon Trust Services, LLC Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5,
including its commitment to provide EV CS certificates in conformity with the CA/Browser
Forum Guidelines on the ATS website, and provided such services in accordance with its
disclosed practices•

maintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

based on the WebTrust Principles and Criteria for Certification Authorities – Extended Validation
Code Signing v1.1
ATS’ management is responsible for its assertion. Our responsibility is to express an opinion on
management’s assertion based on our examination.
We conducted our examination in accordance with standards for attestation engagements
established by the American Institute of Certified Public Accountants and, accordingly, included:(1) obtaining an understanding of ATS’ EV CS certificate lifecycle management businesspractices, including its relevant controls over the issuance, renewal, and revocation of EV
CS certificates;(3) testing and evaluating the operating effectiveness of the controls; and(4) performing such other procedures as we considered necessary in the circumstances.
We believe that our examination provides a reasonable basis for our opinion.
The relative effectiveness and significance of specific controls at ATS and their effect on
assessments of control risk for subscribers and relying parties are dependent on their interaction
with the controls, and other factors present at individual subscriber and relying party locations.
We have performed no procedures to evaluate the effectiveness of controls at individual
subscriber and relying party locations.

BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

Because of the nature and inherent limitations of controls, ATS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detect andcorrect, error, fraud, unauthorized access to systems and information, or failure to comply withinternal and external policies or requirements. Also, the projection of any conclusions based on
our findings to future periods is subject to the risk that changes may alter the validity of suchconclusions.
In our opinion, throughout the period January 16, 2016 to January 15, 2017, ATS management’sassertion, as referred to above, is fairly stated, in all material respects, based on the WebTrust
Principles and Criteria for Certification Authorities – Extended Validation Code Signing v1.1.
During the examination period, ATS did not issue any Extended Validation Code Signing subscribercertificates.
This report does not include any representation as to the quality of ATS’ services beyond those
covered by the WebTrust Principles and Criteria for Certification Authorities – Extended Validation
Code Signing v1.1, nor the suitability of any of ATS’ services for any customer's intended purpose.
ATS’ use of the WebTrust for Certification Authorities – Extended Validation Code Signing Seal
constitutes a symbolic representation of the contents of this report and it is not intended, norshould it be construed, to update this report or provide any additional assurance.

Certified Public Accountants
St. Louis, Missouri
March 28, 20172

Amazon Trust Services LLC Management’s Assertion
March 28, 2017
Amazon Trust Services LLC (“ATS”) operates the Certification Authorities (“CAs”) known as Amazon Root
CA 1, Amazon Root CA 2, Amazon Root CA 3, Amazon Root CA4, Starfield Services Root Certificate
Authority - G2 as listed in Appendix A in scope, and provides Extended Validation Code Signing (“EV CS”)
CA services.
The management of ATS is responsible for establishing and maintaining effective controls over its EV CSCA operations, including its EV CS CA business practices disclosure on its website, EV CS key lifecycle
management controls, and EV CS certificate lifecycle management controls. These controls containmonitoring mechanisms, and actions are taken to correct deficiencies identified.
There are inherent limitations in any controls, including the possibility of human error, and the circumvention
or overriding of controls. Accordingly, even effective controls can only provide reasonable assurance withrespect to ATS’ Certification Authority operations. Furthermore, because of changes in conditions, theeffectiveness of controls may vary over time.
ATS management has assessed its disclosures of its certificate practices and controls over its EV CS CAservices. Based on that assessment, in ATS management’s opinion, in providing its EV CS Certification
Authority (CA) services in the United States of America, throughout the period January 16, 2016 to January
15, 2017, ATS has:•disclosed its extended validation code signing (“EV CS”) certificate lifecycle management businesspractices in its:o Amazon Trust Services Certificate Policy v1.0.4; ando Amazon Trust Services Certification Practice Statement v1.0.5,
including its commitment to provide EV CS certificates in conformity with the CA/Browser Forum
Requirements on the ATS website, and provided such services in accordance with its disclosed
practices•maintained effective controls to provide reasonable assurance that the integrity of keys and EV CS
certificates it manages is established and protected throughout their lifecycles

based on the WebTrust Principles and Criteria for Certification Authorities – Extended Validation CodeSigning, Version 1.1.
During the examination period, ATS did not issue any Extended Validation Code Signing subscribercertificates.

Jonathan Kozolchyk_____________________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services LLC

CN=Amazon Root CA 4,O=Amazon,C=US

CN=Amazon Root CA 3,O=Amazon,C=US

CN=Amazon Root CA 2,O=Amazon,C=US

CN=Amazon Root CA 1,O=Amazon,C=US

Root CAs

2b071c59a0a0ae76b0eadb2bad23bad4580b69c36
01b630c2eaf0613afa83f92

f7ecded5c66047d28ed6466b543c40e0743abe81d109254dcf845d4c2c7853c5

36abc32656acfc645c61b71613c4bf21c787f5cab
bee48348d58597803d7abc9

7f4296fc5b6a4e3b35d3c369623e364ab1af381d8
fa7121533c9d6c633ea2461

fbe3018031f9586bcbf41727e417b7d1c45c2f47f
93be372a17b96b50757d5a2

SHA-256 Hash of Subject Public
Key Information

APPENDIX A – IN-SCOPE CAs

CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\,
Inc.,L=Scottsdale,ST=Arizona,C=US

Notes: Amazon Trust Services assumed operation of Starfield Services Root Certificate Authority - G2 (SFSG2) on June 10, 2015.
Starfield Technologies operated SFSG2 prior to June 10, 2015 and was responsible for the key generation for SFSG2.