Tel: 314-889-1100
Fax: 314-889-1101
www.bdo.com

101 S Hanley Rd, #800
St. Louis, MO 63105

REPORT OF THE INDEPENDENT ACCOUNTANT
To the management of Amazon Trust Services, LLC (“ATS”):
Scope
For ATS’ Certification Authority (“CA”) operations in Washington and Virginia, in the United Statesof America, we have examined whether ATS:•

disclosed its code signing (“CS”) certificate lifecycle management business practices in
the applicable versions of its ATS CPS and ATS CP as enumerated in Attachment A.

including its commitment to provide CS certificates in conformity with the applicable Baseline
Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates,and provided such services in accordance with its disclosed practices•

maintained effective controls to provide reasonable assurance that the integrity of keys
and CS certificates it manages is established and protected throughout their lifecycles

And, for CAs as enumerated in Attachment C are only in scope for Principle 3: Extended Validation
Code Signing Service Requirements:•

maintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

throughout the period January 16, 2021 to January 15, 2022, based on the WebTrust Principles
and Criteria for Certification Authorities – Code Signing Baseline Requirements v2.0.
Certification Authority’s Responsibilities
ATS’ management is responsible for these disclosures and for maintaining effective controls basedon WebTrust Principles and Criteria for Certification Authorities – Code Signing Baseline
Requirements v2.0.
Independent Accountant’s Responsibilities
Our responsibility is to express an opinion, based on our examination, about whether, for its CAs
as enumerated in Attachment B, ATS has:•disclosed its code signing (“CS”) certificate lifecycle management business practices in
the applicable versions of its ATS CPS and ATS CP as enumerated in Attachment A.

including its commitment to provide CS certificates in conformity with the applicable Baseline
Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates,and provided such services in accordance with its disclosed practices
BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of theinternational BDO network of independent member firms.
BDO is the brand name for the BDO network and for each of the BDO Member Firms.

•maintained effective controls to provide reasonable assurance that the integrity of keys
and CS certificates it manages is established and protected throughout their lifecycles

And, for CAs as enumerated in Attachment C are only in scope for Principle 3: Extended Validation
Code Signing Service Requirements:•

maintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

throughout the period January 16, 2021 to January 15, 2022, based on the WebTrust Principles
and Criteria for Certification Authorities – Code Signing Baseline Requirements v2.0.
Our examination was conducted in accordance with attestation standards established by theAmerican Institute of Certified Public Accountants. Those standards require that we plan andperform the examination to obtain reasonable assurance about the disclosures and controls
listed above. An examination involves performing procedures to obtain evidence about thedisclosures and controls listed above. The nature, timing, and extent of the procedures selected
depend on our judgment, including an assessment of the risks of material misstatement of thedisclosures and controls listed above, whether due to fraud or error. We believe that theevidence we obtained is sufficient and appropriate to provide a reasonable basis for our
opinion.
We are required to be independent and to meet our other ethical responsibilities in accordancewith relevant ethical requirements relating to the engagement.
The relative effectiveness and significance of specific controls at ATS and their effect on
assessments of control risk for subscribers and relying parties are dependent on their interaction
with the controls and other factors present at individual subscriber and relying party locations.
Our examination did not extend to controls at individual subscriber and relying party locations
and we have not evaluated the effectiveness of such controls.
Inherent Limitations
There are inherent limitations in the effectiveness of any system of internal control, including
the possibility of human error and the circumvention of controls. For example, because of theirnature, controls may not prevent, or detect unauthorised access to systems and information, or
failure to comply with internal and external policies or requirements. Also, the projection to the
future of any conclusions based on our findings is subject to the risk that controls may become
ineffective.
Basis for Qualified Opinion
During the examination period, we noted the following observation, which caused a qualificationof our opinion:2

Impacted WebTrust Trust Principles and Criteria for
Certification Authorities – Code Signing Baseline
Requirements
2-9.1 The CA maintains controls to provide reasonableassurance that:• It operates a RFC-3161-compliant Timestamp
Authority that is available for use by customers
of its Code Signing Certificates• It recommends to Subscribers that they use
the CA’s Timestamping Authority to time-stamp
signed code.

Control Deficiency Noted
ATS did not operate atimestamp authority during
the examination period.

Qualified Opinion
In our opinion, except for the matter described in the preceding table, ATS has, in all material
respects:•

disclosed its code signing (“CS”) certificate lifecycle management business practices in
the applicable versions of its ATS CPS and ATS CP as enumerated in Attachment A.

including its commitment to provide CS certificates in conformity with the applicable Baseline
Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates,and provided such services in accordance with its disclosed practices•

maintained effective controls to provide reasonable assurance that the integrity of keys
and CS certificates it manages is established and protected throughout their lifecycles

And, for CAs as enumerated in Attachment C are only in scope for Principle 3: Extended Validation
Code Signing Service Requirements:•

maintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

throughout the period January 16, 2021 to January 15, 2022, based on the WebTrust Principles
and Criteria for Certification Authorities – Code Signing Baseline Requirements v2.0.
This report does not include any representation as to the quality of ATS’ services other than its
CA services in Washington and Virginia, in the United States of America, nor the suitability of any
of ATS’ services for any customer's intended purpose.

3

Other Matter
Without modifying our opinion, we noted the following other matters during our procedures:

1

Matter Topic

Matter Description

CA Certificate Content

Amazon Trust Services disclosed in Mozilla Bug #1743935
that it had misissued CA certificates per its CP and CPS
policy.
Amazon Trust Services disclosed in Mozilla Bug #1743943
that revocation of one of the misissued CA certificates
was delayed beyond the required timeline.

April 8, 2022

4

ATTACHMENT A - CERTIFICATION PRACTICE STATEMENT AND CERTIFICATEPOLICY VERSIONS IN-SCOPE
Policy Name
Amazon Trust Services Certificate Policy

Version
1.0.11

Effective Date
August 18, 2021

Amazon Trust Services Certificate Policy

1.0.10July 23, 2021

Amazon Trust Services Certificate Policy

1.0.9

April 23, 2021

Amazon Trust Services Certificate Policy

1.0.8

March 30, 2020

Amazon Trust Services Certification Practice Statement

1.0.12

August 18, 2021

Amazon Trust Services Certification Practice Statement

1.0.11

July 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.10April 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.9

March 30, 2020

5

ATTACHMENT B – LIST OF CAs IN SCOPE FOR CODE SIGNING
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

Valid To

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 1
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint

87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

SPKI SHA256

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

1

Valid From

CN = Amazon Root CA 1
O = Amazon
C = US

Valid From

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/201512/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 4
O = Amazon
C = USSHA2 Thumbprint

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

7

SPKI SHA256

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

Valid From

5/25/2015

Valid To

12/31/2037

ATTACHMENT C – LIST OF CAs IN SCOPE FOR EXTENDED VALIDATION CODE SIGNING
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

Valid To

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 2
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint

87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

SPKI SHA256

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

2

Valid From

CN = Amazon Root CA 1
O = Amazon
C = US

Valid From

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/201512/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

8

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 4
O = Amazon
C = USSHA2 Thumbprint

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

9

SPKI SHA256

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

Valid From

5/25/2015

Valid To

12/31/2037

AMAZON TRUST SERVICES, LLC MANAGEMENT’S ASSERTION
Amazon Trust Services, LLC (“ATS”) operates the Certification Authority (“CA”) services for the
CAs in scope enumerated in Attachment B and Attachment C, and provides code signing (“CS”)
CA services.
ATS management has assessed its disclosures of its certificate practices and controls over its CS
CA services. During our assessment, we noted the following observation, which caused therelevant criteria to not be met:
Impacted WebTrust Trust Principles and Criteria for
Certification Authorities – Code Signing Baseline
Requirements
2-9.1 The CA maintains controls to provide reasonableassurance that:• It operates a RFC-3161-compliant Timestamp
Authority that is available for use by customers
of its Code Signing Certificates• It recommends to Subscribers that they use
the CA’s Timestamping Authority to time-stamp
signed code.

Control Deficiency Noted
ATS did not operate atimestamp authority during
the examination period.

Based on that assessment, in ATS management’s opinion, except for the matter described in thepreceding table in providing its CS CA services in Washington and Virginia, in the United States ofAmerica, ATS has:•disclosed its code signing (“CS”) certificate lifecycle management business practices in
the applicable versions of its ATS Certification Practice Statement (“CPS”) and ATS
Certificate Policy (“CP”) as enumerated in Attachment A.

including its commitment to provide CS certificates in conformity with the applicable Baseline
Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates,and provided such services in accordance with its disclosed practices•

maintained effective controls to provide reasonable assurance that the integrity of keys
and CS certificates it manages is established and protected throughout their lifecycles

And, for CAs as enumerated in Attachment C are only in scope for Principle 3: Extended Validation
Code Signing Service Requirements:•

maintained effective controls to provide reasonable assurance that the integrity of keys
and EV CS certificates it manages is established and protected throughout their lifecycles

throughout the period January 16, 2021 to January 15, 2022, based on the WebTrust Principles
and Criteria for Certification Authorities – Code Signing Certificates v2.0.
During the examination period, ATS did not issue any CS subscriber certificates.

Jonathan Kozolchyk______________________________________________
Jonathan Kozolchyk
Vice President
Amazon Trust Services, LLC
April 8, 2022

ATTACHMENT A - CERTIFICATION PRACTICE STATEMENT AND CERTIFICATEPOLICY VERSIONS IN-SCOPE
Policy Name
Amazon Trust Services Certificate Policy

Version
1.0.11

Effective Date
August 18, 2021

Amazon Trust Services Certificate Policy

1.0.10July 23, 2021

Amazon Trust Services Certificate Policy

1.0.9

April 23, 2021

Amazon Trust Services Certificate Policy

1.0.8

March 30, 2020

Amazon Trust Services Certification Practice Statement

1.0.12

August 18, 2021

Amazon Trust Services Certification Practice Statement

1.0.11

July 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.10April 23, 2021

Amazon Trust Services Certification Practice Statement

1.0.9

March 30, 2020

ATTACHMENT B – LIST OF CAs IN SCOPE FOR CODE SIGNING
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

CN = Amazon Root CA 1
O = Amazon
C = US

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 1
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint
87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

SPKI SHA256
FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

1

Valid From

Valid From

Valid To

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/201512/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 4
O = Amazon
C = USSHA2 Thumbprint

SPKI SHA256

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

Valid From
5/25/2015

Valid To
12/31/2037

ATTACHMENT C – LIST OF CAs IN SCOPE FOR EXTENDED VALIDATION CODE SIGNING
Root CAs
Subject DN

SHA2 Thumbprint

SPKI SHA256

CN = Amazon Root CA 1
O = Amazon
C = US

8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E

FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2

5/25/2015

1/16/2038

CN = Amazon Root CA 2
O = Amazon
C = US

1BA5B2AA8C65401A82960118F80BEC4F62304D83CEC4713A19C39C011EA46DB4

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/2015

5/25/2040

CN = Amazon Root CA 3
O = Amazon
C = US

18CE6CFE7BF14E60B2E347B8DFE868CB31D02EBB3ADA271569F50343B46DB3A4

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/2015

5/25/2040

CN = Amazon Root CA 4
O = Amazon
C = US

E35D28419ED02025CFA69038CD623962458DA5C695FBDEA3C22B0BFB25897092

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

5/25/2015

5/25/2040

CN = Starfield Services
Root Certificate
Authority - G2 2
O = Starfield
Technologies, Inc.
L = Scottsdale
S = Arizona
C = US

568D6905A2C88708A4B3025190EDCFEDB1974A606A13C6E5290FCB2AE63EDAB5

2B071C59A0A0AE76B0EAD
B2BAD23BAD4580B69C360
1B630C2EAF0613AFA83F92

8/31/200912/31/2037

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 1
O = Amazon
C = USSHA2 Thumbprint
87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706

SPKI SHA256
FBE3018031F9586BCBF417
27E417B7D1C45C2F47F93B
E372A17B96B50757D5A2391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861

2

Valid From

Valid From

Valid To

Valid To

5/25/201512/31/2037

10/21/2015

12/31/2037

CN = Amazon Root CA 2
O = Amazon
C = US

8B358466D66126312120645A5875A6A57E3C81D98476A967604244254EAC00F0

7F4296FC5B6A4E3B35D3C369623E364AB1AF381D8FA7121533C9D6C633EA2461

5/25/201512/31/2037

CN = Amazon Root CA 3
O = Amazon
C = US

40C826FDB22BA32A2F9DB4F94770F72B8B1DA9C8FFDA7B11E6F27AF245C89B5E

36ABC32656ACFC645C61B7
1613C4BF21C787F5CABBEE
48348D58597803D7ABC9

5/25/201512/31/2037

ATS assumed operation of this Root CA on June 10, 2015. Starfield Technologies operated this CA prior to June 10, 2015 and was responsible for its key generation.

Cross-Signed Root CAs
Subject DN
CN = Amazon Root CA 4
O = Amazon
C = USSHA2 Thumbprint

SPKI SHA256

543D9B7FC2A6471CD84FCA52C2CF6159DF83EBFCD88D8B08B5AF3F88737F52E6

F7ECDED5C66047D28ED64
66B543C40E0743ABE81D10
9254DCF845D4C2C7853C5

Valid From
5/25/2015

Valid To
12/31/2037