<ConstraintsParameters Name="QES AdESQC TL based" xmlns="http://dss.esig.europa.eu/validation/policy">
	<Description>Validates electronic signatures and indicates whether they are Advanced electronic Signatures (AdES), AdES supported by a Qualified Certificate (AdES/QC) or a
		Qualified electronic Signature (QES). All certificates and their related chains supporting the signatures are validated against the EU Member State Trusted Lists (this includes
		signer's certificate and certificates used to validate certificate validity status services - CRLs, OCSP, and time-stamps).
	</Description>
	<ContainerConstraints>
		<AcceptableContainerTypes Level="FAIL">
			<Id>ASiC-S</Id>
			<Id>ASiC-E</Id>
		</AcceptableContainerTypes>
<!-- 		<ZipCommentPresent Level="WARN" /> -->
<!-- 		<AcceptableZipComment Level="WARN"> -->
<!-- 			<Id>mimetype=application/vnd.etsi.asic-s+zip</Id> -->
<!-- 			<Id>mimetype=application/vnd.etsi.asic-e+zip</Id> -->
<!-- 		</AcceptableZipComment> -->
		<MimeTypeFilePresent Level="INFORM" />
		<AcceptableMimeTypeFileContent Level="WARN">
			<Id>application/vnd.etsi.asic-s+zip</Id>
			<Id>application/vnd.etsi.asic-e+zip</Id>
		</AcceptableMimeTypeFileContent>
		<ManifestFilePresent Level="FAIL" />
		<SignedFilesPresent Level="FAIL" />
		<FilenameAdherence Level="WARN" />
		<AllFilesSigned Level="WARN" />
	</ContainerConstraints>
	<PDFAConstraints>
		<!-- PDF/A only -->
<!--		<AcceptablePDFAProfiles Level="WARN">-->
<!--			<Id>PDF/A-2A</Id>-->
<!--			<Id>PDF/A-2B</Id>-->
<!--			<Id>PDF/A-2U</Id>-->
<!--		</AcceptablePDFAProfiles>-->
<!--		<PDFACompliant Level="WARN" />-->
	</PDFAConstraints>
	<SignatureConstraints>
		<StructuralValidation Level="WARN" />
		<AcceptablePolicies Level="FAIL">
			<Id>ANY_POLICY</Id>
			<Id>NO_POLICY</Id>
		</AcceptablePolicies>
		<PolicyAvailable Level="INFORM" />
		<PolicyHashMatch Level="WARN" />
		<AcceptableFormats Level="FAIL">
			<Id>*</Id>
		</AcceptableFormats>
		<BasicSignatureConstraints>
			<ReferenceDataExistence Level="FAIL" />
			<ReferenceDataIntact Level="FAIL" />
			<ReferenceDataNameMatch Level="WARN" />
			<ManifestEntryObjectExistence Level="WARN" />
			<ManifestEntryObjectGroup Level="WARN" />
			<ManifestEntryObjectIntact Level="FAIL" />
			<ManifestEntryNameMatch Level="WARN" />
			<SignatureIntact Level="FAIL" />
			<SignatureDuplicated Level="FAIL" />
			<ProspectiveCertificateChain Level="FAIL" />
			<SignerInformationStore Level="FAIL" />
			<ByteRange Level="FAIL" />
			<ByteRangeCollision Level="WARN" />
			<PdfSignatureDictionary Level="FAIL" />
			<PdfPageDifference Level="FAIL" />
			<PdfAnnotationOverlap Level="WARN" />
			<PdfVisualDifference Level="WARN" />
			<DocMDP Level="WARN" />
			<FieldMDP Level="WARN" />
			<SigFieldLock Level="WARN" />
			<UndefinedChanges Level="WARN" />
<!-- 			<TrustServiceTypeIdentifier Level="WARN"> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/Svctype/CA/QC</Id> -->
<!-- 			</TrustServiceTypeIdentifier> -->
<!-- 			<TrustServiceStatus Level="FAIL"> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/undersupervision</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accredited</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/supervisionincessation</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/withdrawn</Id> -->
<!-- 			</TrustServiceStatus> -->
			<SigningCertificate>
				<Recognition Level="FAIL" />
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<AuthorityInfoAccessPresent Level="WARN" />
				<RevocationDataSkip Level="INFORM">
					<CertificateExtensions>
						<Id>0.4.0.194121.2.1</Id> <!-- valassured-ST-certs -->
						<Id>2.5.29.56</Id> <!-- noRevAvail -->
					</CertificateExtensions>
				</RevocationDataSkip>
				<RevocationInfoAccessPresent Level="WARN" />
				<RevocationDataAvailable Level="FAIL" />
				<AcceptableRevocationDataFound Level="FAIL" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<KeyUsage Level="WARN">
					<Id>nonRepudiation</Id>
				</KeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<NoRevAvail Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<SerialNumberPresent Level="WARN" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<RevocationIssuerNotExpired Level="FAIL" />
				<NotSelfSigned Level="WARN" />
<!--				<QcCompliance Level="WARN" /> -->
<!--				<QcSSCD Level="WARN" /> -->
<!-- 				<QcLegislationCountryCodes Level="WARN" /> -->
<!-- 				<IssuedToNaturalPerson Level="INFORM" /> -->
<!-- 				<IssuedToLegalPerson Level="INFORM" /> -->
				<UsePseudonym Level="INFORM" />
				<Cryptographic />
			</SigningCertificate>
			<CACertificate>
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<RevocationDataAvailable Level="FAIL" />
				<AcceptableRevocationDataFound Level="FAIL" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<CA Level="FAIL" />
				<MaxPathLength Level="FAIL" />
				<KeyUsage Level="FAIL">
					<Id>keyCertSign</Id>
				</KeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
					<Id>2.5.29.56</Id> <!-- noRevAvail -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<Cryptographic />
			</CACertificate>
			<Cryptographic />
		</BasicSignatureConstraints>
		<SignedAttributes>
			<SigningCertificatePresent Level="WARN" />
			<UnicitySigningCertificate Level="WARN" />
			<SigningCertificateRefersCertificateChain Level="WARN" />
			<SigningCertificateDigestAlgorithm Level="WARN" />
			<CertDigestPresent Level="FAIL" />
			<CertDigestMatch Level="FAIL" />
			<IssuerSerialMatch Level="WARN" />
			<KeyIdentifierMatch Level="WARN" />
			<SigningTime Level="FAIL" />
			<MessageDigestOrSignedPropertiesPresent Level="FAIL" />
			<EllipticCurveKeySize Level="WARN" />
<!--		<ContentType Level="FAIL" value="1.2.840.113549.1.7.1" />
			<ContentHints Level="FAIL" value="*" />
			<CommitmentTypeIndication Level="FAIL">
				<Id>1.2.840.113549.1.9.16.6.1</Id>
				<Id>1.2.840.113549.1.9.16.6.4</Id>
				<Id>1.2.840.113549.1.9.16.6.5</Id>
				<Id>1.2.840.113549.1.9.16.6.6</Id>
			</CommitmentTypeIndication>
			<SignerLocation Level="FAIL" />
			<ContentTimeStamp Level="FAIL" /> -->
		</SignedAttributes>
		<UnsignedAttributes>
<!--		<CounterSignature Level="IGNORE" /> check presence -->
		</UnsignedAttributes>
	</SignatureConstraints>
	<CounterSignatureConstraints>
		<BasicSignatureConstraints>
			<ReferenceDataExistence Level="FAIL" />
			<ReferenceDataIntact Level="FAIL" />
			<ReferenceDataNameMatch Level="WARN" />
			<ManifestEntryObjectExistence Level="WARN" />
			<ManifestEntryObjectGroup Level="WARN" />
			<ManifestEntryObjectIntact Level="FAIL" />
			<ManifestEntryNameMatch Level="WARN" />
			<SignatureIntact Level="FAIL" />
			<SignatureDuplicated Level="FAIL" />
			<ProspectiveCertificateChain Level="FAIL" />
<!-- 			<TrustServiceTypeIdentifier Level="WARN"> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/Svctype/CA/QC</Id> -->
<!-- 			</TrustServiceTypeIdentifier> -->
<!-- 			<TrustServiceStatus Level="FAIL"> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/undersupervision</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/accredited</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/supervisionincessation</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/granted</Id> -->
<!-- 				<Id>http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/withdrawn</Id> -->
<!-- 			</TrustServiceStatus> -->
			<SigningCertificate>
				<Recognition Level="FAIL" />
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<AuthorityInfoAccessPresent Level="WARN" />
				<RevocationDataSkip Level="INFORM">
					<CertificateExtensions>
						<Id>0.4.0.194121.2.1</Id> <!-- valassured-ST-certs -->
						<Id>2.5.29.56</Id> <!-- noRevAvail -->
					</CertificateExtensions>
				</RevocationDataSkip>
				<RevocationInfoAccessPresent Level="WARN" />
				<RevocationDataAvailable Level="FAIL" />
				<AcceptableRevocationDataFound Level="FAIL" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<KeyUsage Level="WARN">
					<Id>nonRepudiation</Id>
				</KeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<NoRevAvail Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<SerialNumberPresent Level="WARN" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<NotSelfSigned Level="WARN" />
<!--				<QcCompliance Level="WARN" /> -->
<!--				<QcSSCD Level="WARN" /> -->
<!-- 				<IssuedToNaturalPerson Level="INFORM" /> -->
<!-- 				<IssuedToLegalPerson Level="INFORM" /> -->
				<UsePseudonym Level="INFORM" />
				<Cryptographic />
			</SigningCertificate>
			<CACertificate>
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<RevocationDataAvailable Level="FAIL" />
				<AcceptableRevocationDataFound Level="FAIL" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<CA Level="FAIL" />
				<MaxPathLength Level="FAIL" />
				<KeyUsage Level="FAIL">
					<Id>keyCertSign</Id>
				</KeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
					<Id>2.5.29.56</Id> <!-- noRevAvail -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<Cryptographic />
			</CACertificate>
			<Cryptographic />
		</BasicSignatureConstraints>
		<SignedAttributes>
			<SigningCertificatePresent Level="WARN" />
			<UnicitySigningCertificate Level="WARN" />
			<SigningCertificateRefersCertificateChain Level="WARN" />
			<SigningCertificateDigestAlgorithm Level="WARN" />
			<CertDigestPresent Level="FAIL" />
			<CertDigestMatch Level="FAIL" />
			<IssuerSerialMatch Level="WARN" />
			<KeyIdentifierMatch Level="WARN" />
			<SigningTime Level="FAIL" />
			<MessageDigestOrSignedPropertiesPresent Level="FAIL" />
			<EllipticCurveKeySize Level="WARN" />
<!--		<ContentType Level="FAIL" value="1.2.840.113549.1.7.1" />
			<ContentHints Level="FAIL" value="*" />
			<CommitmentTypeIndication Level="FAIL">
				<Id>1.2.840.113549.1.9.16.6.1</Id>
				<Id>1.2.840.113549.1.9.16.6.4</Id>
				<Id>1.2.840.113549.1.9.16.6.5</Id>
				<Id>1.2.840.113549.1.9.16.6.6</Id>
			</CommitmentTypeIndication>
			<SignerLocation Level="FAIL" />
			<ContentTimeStamp Level="FAIL" /> -->
		</SignedAttributes>
	</CounterSignatureConstraints>
	<Timestamp>
		<TimestampDelay Level="IGNORE" Unit="DAYS" Value="0" />
		<RevocationTimeAgainstBestSignatureTime	Level="FAIL" />
		<BestSignatureTimeBeforeExpirationDateOfSigningCertificate Level="FAIL" />
		<Coherence Level="WARN" />
		<BasicSignatureConstraints>
			<ReferenceDataExistence Level="FAIL" />
			<ReferenceDataIntact Level="FAIL" />
			<ReferenceDataNameMatch Level="WARN" />
			<ManifestEntryObjectExistence Level="WARN" />
			<ManifestEntryObjectGroup Level="WARN" />
			<ManifestEntryObjectIntact Level="FAIL" />
			<ManifestEntryNameMatch Level="WARN" />
			<SignatureIntact Level="FAIL" />
			<ProspectiveCertificateChain Level="FAIL" />
			<ByteRange Level="FAIL" />
			<ByteRangeCollision Level="WARN" />
			<PdfSignatureDictionary Level="FAIL" />
			<PdfPageDifference Level="FAIL" />
			<PdfAnnotationOverlap Level="WARN" />
			<PdfVisualDifference Level="WARN" />
			<DocMDP Level="WARN" />
			<FieldMDP Level="WARN" />
			<SigFieldLock Level="WARN" />
			<UndefinedChanges Level="WARN" />
			<SigningCertificate>
				<Recognition Level="FAIL" />
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<RevocationDataAvailable Level="FAIL" />
				<AcceptableRevocationDataFound Level="FAIL" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<ExtendedKeyUsage Level="FAIL">
					<Id>timeStamping</Id>
				</ExtendedKeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<NotSelfSigned Level="WARN" />
				<Cryptographic />
			</SigningCertificate>
			<CACertificate>
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<RevocationDataAvailable Level="WARN" />
				<AcceptableRevocationDataFound Level="WARN" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<CA Level="FAIL" />
				<MaxPathLength Level="FAIL" />
				<KeyUsage Level="FAIL">
					<Id>keyCertSign</Id>
				</KeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
					<Id>2.5.29.56</Id> <!-- noRevAvail -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<Cryptographic />
			</CACertificate>
			<Cryptographic />
		</BasicSignatureConstraints>
		<SignedAttributes>
			<SigningCertificatePresent Level="WARN" />
			<!-- <UnicitySigningCertificate Level="WARN" /> RFC 5816 -->
			<SigningCertificateRefersCertificateChain Level="WARN" />
			<!-- <SigningCertificateDigestAlgorithm Level="WARN" /> TODO : too strict to enforce now -->
			<CertDigestPresent Level="WARN" />
			<IssuerSerialMatch Level="WARN" />
		</SignedAttributes>
		<TSAGeneralNameContentMatch Level="WARN" />
		<AtsHashIndex Level="WARN" />
		<ContainerSignedAndTimestampedFilesCovered Level="FAIL" />
	</Timestamp>
	<Revocation>
        <UnknownStatus Level="FAIL" />
		<ThisUpdatePresent Level="FAIL" />
		<RevocationIssuerKnown Level="FAIL" />
		<RevocationIssuerValidAtProductionTime Level="FAIL" />
		<RevocationAfterCertificateIssuance Level="FAIL" />
		<RevocationHasInformationAboutCertificate Level="FAIL" />
		<OCSPResponderIdMatch Level="FAIL" />
        <SelfIssuedOCSP Level="WARN" />
		<BasicSignatureConstraints>
			<ReferenceDataExistence Level="FAIL" />
			<ReferenceDataIntact Level="FAIL" />
			<SignatureIntact Level="FAIL" />
			<ProspectiveCertificateChain Level="FAIL" />
			<SigningCertificate>
				<Recognition Level="FAIL" />
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<RevocationDataSkip Level="IGNORE">
					<CertificateExtensions>
						<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
					</CertificateExtensions>
				</RevocationDataSkip>
				<RevocationDataAvailable Level="FAIL" />
				<AcceptableRevocationDataFound Level="FAIL" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<IssuerName Level="FAIL" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<Cryptographic />
			</SigningCertificate>
			<CACertificate>
				<Signature Level="FAIL" />
				<NotExpired Level="FAIL" />
				<SunsetDate Level="FAIL" />
				<RevocationDataAvailable Level="WARN" />
				<AcceptableRevocationDataFound Level="WARN" />
				<CRLNextUpdatePresent Level="WARN" />
				<RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
				<CA Level="FAIL" />
				<MaxPathLength Level="FAIL" />
				<KeyUsage Level="FAIL">
					<Id>keyCertSign</Id>
				</KeyUsage>
				<PolicyTree Level="WARN" />
				<NameConstraints Level="WARN" />
				<SupportedCriticalExtensions Level="WARN">
					<Id>2.5.29.15</Id> <!-- keyUsage -->
					<Id>2.5.29.32</Id> <!-- certificatePolicies -->
					<Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
					<Id>2.5.29.19</Id> <!-- basicConstraints -->
					<Id>2.5.29.30</Id> <!-- nameConstraints -->
					<Id>2.5.29.36</Id> <!-- policyConstraints -->
					<Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
					<Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
					<Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
					<Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
					<!-- policyMappings 2.5.29.33 not supported -->
				</SupportedCriticalExtensions>
				<ForbiddenExtensions Level="FAIL">
					<Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
					<Id>2.5.29.56</Id> <!-- noRevAvail -->
				</ForbiddenExtensions>
				<IssuerName Level="FAIL" />
				<NotRevoked Level="FAIL" />
				<NotOnHold Level="FAIL" />
				<Cryptographic />
			</CACertificate>
			<Cryptographic />
		</BasicSignatureConstraints>
	</Revocation>
	<EvidenceRecord>
		<DataObjectExistence Level="FAIL" />
		<DataObjectIntact Level="FAIL" />
		<DataObjectFound Level="FAIL" />
		<DataObjectGroup Level="WARN" />
		<SignedFilesCovered Level="WARN" />
		<ContainerSignedAndTimestampedFilesCovered Level="WARN" />
		<HashTreeRenewal Level="FAIL" />
		<Cryptographic />
	</EvidenceRecord>
	<Cryptographic Level="FAIL">
		<AcceptableEncryptionAlgo>
			<Algo>RSA</Algo>
			<Algo>RSASSA-PSS</Algo>
			<Algo>DSA</Algo>
			<Algo>ECDSA</Algo>
			<Algo>PLAIN-ECDSA</Algo>
<!-- 		<Algo>EdDSA</Algo> 				Not referenced in ETSI/SOGIS -->
		</AcceptableEncryptionAlgo>
		<MiniPublicKeySize>
			<Algo Size="1024">DSA</Algo>
			<Algo Size="786">RSA</Algo>
			<Algo Size="786">RSASSA-PSS</Algo>
			<Algo Size="160">ECDSA</Algo>
			<Algo Size="160">PLAIN-ECDSA</Algo>
<!-- 		<Algo Size="24">EdDSA</Algo> 		Not referenced in ETSI/SOGIS -->
		</MiniPublicKeySize>
		<AcceptableDigestAlgo>
<!--		<Algo>MD2</Algo> 		Not referenced in ETSI/SOGIS -->
			<Algo>MD5</Algo>
			<Algo>SHA1</Algo>
			<Algo>SHA224</Algo>
			<Algo>SHA256</Algo>
			<Algo>SHA384</Algo>
			<Algo>SHA512</Algo>
<!--		<Algo>SHA3-224</Algo> 		Not referenced in ETSI/SOGIS -->
			<Algo>SHA3-256</Algo>
			<Algo>SHA3-384</Algo>
			<Algo>SHA3-512</Algo>
			<Algo>RIPEMD160</Algo>
			<Algo>WHIRLPOOL</Algo>
		</AcceptableDigestAlgo>
		<AlgoExpirationDate Level="FAIL" Format="yyyy-MM-dd" UpdateDate="2024-10-13" LevelAfterUpdate="WARN">
			<!-- Digest algorithms -->
			<Algo Date="2004-08-01">MD5</Algo> <!-- ETSI TS 102 176-1 (Historical) V2.1.1 -->
			<Algo Date="2012-08-01">SHA1</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2029-01-01">SHA224</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo>SHA256</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo>SHA384</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo>SHA512</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo>SHA3-256</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo>SHA3-384</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo>SHA3-512</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo Date="2014-08-01">RIPEMD160</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2020-12-01">WHIRLPOOL</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<!-- end Digest algorithms -->
			<!-- Encryption algorithms -->
			<Algo Date="2015-12-01" Size="1024">DSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2029-01-01" Size="1900">DSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Size="3000">DSA</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo Date="2010-08-01" Size="786">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2019-10-01" Size="1024">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2019-10-01" Size="1536">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2029-01-01" Size="1900">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2029-01-01" Size="3000">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2010-08-01" Size="786">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2019-10-01" Size="1024">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2019-10-01" Size="1536">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2029-01-01" Size="1900">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Size="3000">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo Date="2012-08-01" Size="160">ECDSA</Algo> <!-- ETSI TS 102 176-1 (Historical) V2.1.1 -->
			<Algo Date="2012-08-01" Size="163">ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2021-10-01" Size="224">ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Size="256">ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<Algo Date="2012-08-01" Size="160">PLAIN-ECDSA</Algo> <!-- ETSI TS 102 176-1 (Historical) V2.1.1 -->
			<Algo Date="2012-08-01" Size="163">PLAIN-ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Date="2021-10-01" Size="224">PLAIN-ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
			<Algo Size="256">PLAIN-ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
			<!-- end Encryption algorithms -->
		</AlgoExpirationDate>
	</Cryptographic> 
	
	<Model Value="SHELL" />
	
	<!-- eIDAS REGL 910/EU/2014 --> 
	<eIDAS>
		<TLFreshness Level="WARN" Unit="HOURS" Value="6" />
		<TLNotExpired Level="WARN" />
		<TLWellSigned Level="WARN" />
		<TLVersion Level="FAIL">
			<Id>5</Id>
			<Id>6</Id>
		</TLVersion>
		<TLStructure Level="WARN" />
	</eIDAS>
</ConstraintsParameters>
