SWITCHaai Root CA Repository

This is the repository for the SWITCHaai Root CA, which is mainly a collection of reference material about this certification authority.

CP/CPS Documents

• SWITCHaai Root CA Certificate Policy and Certification Practice Statement, Version 1.1 (19 July 2011, OID 2.16.756.1.2.6.6.1.1)
• SWITCHaai Metadata Signing CA Certificate Policy and Certification Practice Statement, Version 1.2 (19 July 2011, OID 2.16.756.1.2.6.7.1.2)
• SWITCHaai Interfederation Metadata Signing CA Certificate Policy and Certification Practice Statement, Version 1.0 (19 July 2011, OID 2.16.756.1.2.6.8.1.0)

Archived CP/CPS versions

• SWITCHaai Root CA Certificate Policy and Certification Practice Statement, Version 1.0 (15 July 2008, OID 2.16.756.1.2.6.6.1.0)
• SWITCHaai Metadata Signing CA Certificate Policy and Certification Practice Statement, Version 1.1 (9 May 2011, OID 2.16.756.1.2.6.7.1.1)
• SWITCHaai Metadata Signing CA Certificate Policy and Certification Practice Statement, Version 1.0 (15 July 2008, OID 2.16.756.1.2.6.7.1.0)

CA Hierarchy

Currently, the SWITCHaai Root CA has two subordinate CAs, as depicted below:

CA Certificates

• SWITCHaai Root CA certificate: DER format PEM format

  Validity:	2008-05-15 to 2028-05-15
  Subject:	SWITCHaai Root CA
  SHA256 Fingerprint:	37:DC:E4:D7:1C:24:42:32:6A:0F:85:B6:12:00:22:C7:54:AA:FF:B2:8C:BF:CF:69:EB:F3:F7:31:90:3C:09:5A
  SHA1 Fingerprint:	3C:E2:5A:E0:9D:B4:BB:2B:FD:33:3C:22:80:39:F7:FC:4A:F9:2C:E9

• SWITCHaai Metadata Signing CA 2025 certificate: DER format PEM format

  Validity:	2025-04-15 to 2028-05-15
  Subject:	SWITCHaai Metadata Signing CA 2025
  Signing CA:	SWITCHaai Root CA
  SHA256 Fingerprint:	10:6D:07:CF:10:DF:5C:AF:7A:A2:AC:52:EE:AC:45:64:3C:AA:3C:D1:1C:70:52:18:94:6A:75:05:A1:7F:5A:6F
  SHA1 Fingerprint:	19:F8:44:B4:47:D9:21:67:2D:B3:35:43:14:12:74:A3:B2:32:61:29

• SWITCHaai Interfederation Metadata Signing CA 2025 certificate: DER format PEM format

  Validity:	2025-04-15 to 2028-05-15
  Subject:	SWITCHaai Interfederation Metadata Signing CA 2025
  Signing CA:	SWITCHaai Root CA
  SHA256 Fingerprint:	D3:F2:F6:C8:DA:D0:25:FE:0E:CE:56:CB:63:D8:77:EB:6F:35:C6:73:56:E9:FB:59:47:76:5B:8E:17:63:02:A2
  SHA1 Fingerprint:	18:42:53:32:60:5D:67:C0:51:BF:AC:7B:70:45:C7:39:06:69:23:57

Metadata Signer Certificates

Note: Usually, the "SWITCHaai Root CA" certificate should be used to verify the metadata signatures. If a SAML implementation doesn't support this, the following certificates can be configured for metadata verification. In this case, deployers need to make sure to update the certificate when SWITCH starts using a new one.

• SWITCHaai Metadata Signer 2025 certificate: DER format PEM format

  Validity:	2025-04-15 to 2028-05-15
  Subject:	SWITCHaai Metadata Signer
  Signing CA:	SWITCHaai Metadata Signing CA 2025
  SHA256 Fingerprint:	DF:39:F4:36:D4:A4:EE:3C:C6:CD:A7:FC:3F:27:0E:36:1A:5B:5C:DC:55:3D:4D:EF:B9:FE:92:4C:EF:E1:C5:56
  SHA1 Fingerprint:	EA:88:03:8C:4B:A0:79:30:0B:34:E2:73:A6:0E:A2:3C:9C:0A:36:2D
  Signed metadata files:	metadata.switchaai.xml, metadata.switchaai+idp.xml, metadata.switchaai+sp.xml, metadata.aaitest.xml, metadata.aaitest+idp.xml, metadata.aaitest+sp.xml, metadata.eduid.xml, metadata.eduid-test.xml, metadata.edugain.xml

• SWITCHaai Interfederation Metadata Signer 2025 certificate: DER format PEM format

  Validity:	2025-04-15 to 2028-05-15
  Subject:	SWITCHaai Interfederation Metadata Signer
  Signing CA:	SWITCHaai Interfederation Metadata Signing CA 2025
  SHA256 Fingerprint:	48:8D:EA:AD:2B:62:6E:76:28:C4:40:CE:F3:89:B3:BF:40:80:10:BB:46:90:7E:2A:0B:7B:D2:C7:73:54:88:6A
  SHA1 Fingerprint:	2E:0A:1E:FF:9C:5C:B9:2B:02:AE:4B:9F:35:E7:D8:F8:66:F0:5F:42
  Signed metadata files:	metadata.interfederation.xml, metadata.interfederation+idp.xml, metadata.interfederation+sp.xml

Certificate Revocation Lists (CRL)

• SWITCHaai Root CA CRL
• SWITCHaai Metadata Signing CA 2025 CRL
• SWITCHaai Interfederation Metadata Signing CA 2025 CRL