{           {             type { 2 5 4 6 },             value PrintableString : "DE"           }         },         {           {             type { 2 5 4 10 },             value UTF8String :Santesson, et al.           Standards Track                    [Page 27]RFC 3039             Qualified Certificates Profile         January 2001               "GMD Forschungszentrum Informationstechnik GmbH"           }         },         {           {             type { 2 5 4 4 },             value UTF8String : "Barzin"           },           {             type { 2 5 4 42 },             value UTF8String : "Petra"           }         }       },     subjectPublicKeyInfo     {       algorithm       {         algorithm { 1 2 840 113549 1 1 1 },         parameters RSAParams : NULL       },       subjectPublicKey '00110000 10000001 10000111 00000010 1000 ...'B     },     extensions     {       {         extnId { 2 5 29 9 },  -- subjectDirectoryAttributes         extnValue '305B301006082B06010505070904310413024445300F0 ...'H       },       {         extnId { 2 5 29 15 }, -- keyUsage         critical TRUE,         extnValue '03020640'H       },       {         extnId { 2 5 29 32 }, -- certificatePolicies         extnValue '3009300706052B24080101'H       },       {         extnId { 2 5 29 35 }, -- authorityKeyIdentifier         extnValue '30168014000102030405060708090A0B0C0D0E0FFEDCBA98'H       },       {         extnId { 1 3 6 1 5 5 7 1 3 }, -- qcStatements         extnValue '302B302906082B06010505070B01301D301B81196D756 ...'H       }     }   }Santesson, et al.           Standards Track                    [Page 28]RFC 3039             Qualified Certificates Profile         January 2001C.2 ASN.1 dump   This section contains an ASN.1 dump of the signed portion of the   certificate.  Some values has been truncated for readability   purposes.   TBSCertificate SEQUENCE: tag = [UNIVERSAL 16] constructed;     length = 631     version : tag = [0] constructed; length = 3       Version INTEGER: tag = [UNIVERSAL 2] primitive; length = 1         2     serialNumber CertificateSerialNumber INTEGER: tag = [UNIVERSAL 2]       primitive; length = 4       1234567890     signature AlgorithmIdentifier SEQUENCE: tag = [UNIVERSAL 16]       constructed; length = 13       algorithm OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;         length = 9         { 1 2 840 113549 1 1 5 }       parameters OpenType: NULL: tag = [UNIVERSAL 5] primitive;         length = 0         NULL     issuer Name CHOICE       rdnSequence RDNSequence SEQUENCE OF: tag = [UNIVERSAL 16]         constructed; length = 72         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]           constructed; length = 11           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]             constructed; length = 9             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;               length = 3               { 2 5 4 6 }             value OpenType: PrintableString: tag = [UNIVERSAL 19]               primitive; length = 2               "DE"         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]           constructed; length = 57           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]           constructed; length = 55             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;               length = 3               { 2 5 4 10 }             value OpenType : UTF8String: tag = [UNIVERSAL 12]               primitive; length = 48               0x474d44202d20466f72736368756e67737a656e7472756d2049...     validity Validity SEQUENCE: tag = [UNIVERSAL 16] constructed;       length = 30       notBefore Time CHOICESantesson, et al.           Standards Track                    [Page 29]RFC 3039             Qualified Certificates Profile         January 2001         utcTime UTCTime: tag = [UNIVERSAL 23] primitive; length = 13           000501100000Z       notAfter Time CHOICE         utcTime UTCTime: tag = [UNIVERSAL 23] primitive; length = 13           001101100000Z     subject Name CHOICE       rdnSequence RDNSequence SEQUENCE OF: tag = [UNIVERSAL 16]         constructed; length = 101         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]           constructed; length = 11           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]             constructed; length = 9             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;               length = 3               { 2 5 4 6 }             value OpenType: PrintableString: tag = [UNIVERSAL 19]               primitive; length = 2               "DE"         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]           constructed; length = 55           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]             constructed; length = 53             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;               length = 3               { 2 5 4 10 }             value OpenType: UTF8String: tag = [UNIVERSAL 12]               primitive; length = 46               0x474d4420466f72736368756e67737a656e7472756d20496e66...         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]           constructed; length = 29           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]             constructed; length = 13             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;               length = 3               { 2 5 4 4 }             value OpenType: UTF8String: tag = [UNIVERSAL 12]               primitive; length = 6               0x4261727a696e           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]             constructed; length = 12             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;               length = 3               { 2 5 4 42 }             value OpenType: UTF8String: tag = [UNIVERSAL 12]               primitive; length = 5               0x5065747261     subjectPublicKeyInfo SubjectPublicKeyInfo SEQUENCE: tag =       [UNIVERSAL 16] constructed; length = 157Santesson, et al.           Standards Track                    [Page 30]RFC 3039             Qualified Certificates Profile         January 2001       algorithm AlgorithmIdentifier SEQUENCE: tag = [UNIVERSAL 16]         constructed; length = 13         algorithm OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;           length = 9           { 1 2 840 113549 1 1 1 }         parameters OpenType: NULL: tag = [UNIVERSAL 5] primitive;           length = 0           NULL       subjectPublicKey BIT STRING: tag = [UNIVERSAL 3] primitive;         length = 139         0x0030818702818100b8488400d4b6088be48ead459ca19ec717aaf3d1d...     extensions : tag = [3] constructed; length = 233       Extensions SEQUENCE OF: tag = [UNIVERSAL 16] constructed;         length = 230         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;           length = 100           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;             length = 3             { 2 5 29 9 }           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;             length = 93             0x305b301006082b06010505070904310413024445300f06082b060...         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;           length = 14           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;             length = 3             { 2 5 29 15 }           critical BOOLEAN: tag = [UNIVERSAL 1] primitive; length = 1             TRUE           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;             length = 4             0x03020640         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;           length = 18           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;             length = 3             { 2 5 29 32 }           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;             length = 11             0x3009300706052b24080101         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;           length = 31           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;             length = 3             { 2 5 29 35 }           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;             length = 24             0x30168014000102030405060708090a0b0c0d0e0ffedcba98Santesson, et al.           Standards Track                    [Page 31]RFC 3039             Qualified Certificates Profile         January 2001         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;           length = 57           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;             length = 8             { 1 3 6 1 5 5 7 1 3 }           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;             length = 45             0x302b302906082b06010505070b01301d301b81196d756e6963697...C.3 DER-encoding   This section contains the full, DER-encoded certificate, in hex.   3082030E30820277A0030201020204499602D2300D06092A864886F70D010105   05003048310B300906035504061302444531393037060355040A0C30474D4420   2D20466F72736368756E67737A656E7472756D20496E666F726D6174696F6E73   746563686E696B20476D6248301E170D3030303530313130303030305A170D30   30313130313130303030305A3065310B30090603550406130244453137303506   0355040A0C2E474D4420466F72736368756E67737A656E7472756D20496E666F   726D6174696F6E73746563686E696B20476D6248311D300C060355042A0C0550   65747261300D06035504040C064261727A696E30819D300D06092A864886F70D   010101050003818B0030818702818100B8488400D4B6088BE48EAD459CA19EC7   17AAF3D1D4EE3ECCA496128A13597D16CC8B85EB37EFCE110C63B01E684E5CF6   32291EAC60FD153C266EAAC36AD4CEA92319F9BFDD261AD2BFE41EAB4E17FE67   8341EE52D9A0A8B4DEC07B7ACC76762514045CEE9994E0CF37BAE05F8DE33B35   FF98BCE77742CE4B12273BD122137FE9020105A381E93081E630640603551D09   045D305B301006082B06010505070904310413024445300F06082B0601050507   09033103130146301D06082B060105050709013111180F313937313130313430   30303030305A301706082B06010505070902310B0C094461726D737461647430   0E0603551D0F0101FF04040302064030120603551D20040B3009300706052B24   080101301F0603551D23041830168014000102030405060708090A0B0C0D0E0F   FEDCBA98303906082B06010505070103042D302B302906082B06010505070B01   301D301B81196D756E69636970616C697479406461726D73746164742E646530   0D06092A864886F70D01010505000381810048FD14D9AFE961E4321D9AA40CC0   1C12893550CF76FBECBDE448926B0AE6F904AB89E7B5F808666FB007218AC18D   28CE1E2D40FBF8C16B275CBA0547D7885B74059DEC736223368FC1602A510BC1   EB31E39F3967BE6B413D48BC743A0AB19C57FD20F3B393E8FEBD8B05CAA5007D   AD36F9D789AEF636A0AC0F93BCB3711B5907Santesson, et al.           Standards Track                    [Page 32]RFC 3039             Qualified Certificates Profile         January 2001C.4 CA's public RSA key   This section contains the DER-encoded public RSA key of the CA who   signed the example certificate.  It is included with the purpose of   simplifying verifications of the example certificate.   30818902818100ad1f35964b3674c807b9f8a645d2c8174e514b69a4b46a7382   915abbc44eccede914dae8fcc023abcea9c53380e641795cb0dda664b872fc10   9f9bbb852bf42d994f634c681608e388dce240b558513e5b60027bd1a07cef9c   9b6db37c7e1f1abd238eed96e4b669056b260f55e83f14e6027127c9deb3ad18   afcd3f8a5f5bf50203010001Santesson, et al.           Standards Track                    [Page 33]RFC 3039             Qualified Certificates Profile         January 2001Authors' Addresses   Stefan Santesson   AddTrust AB   P.O. Box 465   S-201 24 Malmo   Sweden   EMail: stefan@addtrust.com   Tim Polk   NIST   Building 820, Room 426   Gaithersburg, MD 20899, USA   EMail: wpolk@nist.gov   Petra Barzin   SECUDE - Sicherhei