{
  "Version": "plants-05",
  "ID": "32473.1",
  "LogNumber": 1,
  "Cosigners": [
    {
      "CosignerID": "32473.1",
      "SignatureAlgorithm": "mldsa44",
      "PrivateKey": "MDQCAQAwCwYJYIZIAWUDBAMRBCKAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
    },
    {
      "CosignerID": "32473.2.1",
      "SignatureAlgorithm": "ecdsa_p256_sha256",
      "PrivateKey": "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgthrguld6LZNJw6UMbhyTkML7u3BMcdEyomQIwB+N2o6hRANCAAR6nKeTu+M2OxL7HCjH/i0+lnIx7OE0b3DnXWVue+5TBVDq8aG6KqFq+xprV5ll6QtPJb+TTBp+Kv1IRpDxMpxt"
    },
    {
      "CosignerID": "32473.2.2",
      "SignatureAlgorithm": "mldsa65",
      "PrivateKey": "MDQCAQAwCwYJYIZIAWUDBAMSBCKAIAABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4f"
    }
  ],
  "CACert": {
    "NotBefore": "2020-01-01T00:00:00Z",
    "NotAfter": "2030-12-31T23:59:59Z",
    "IsCA": true,
    "KeyUsage": ["CertSign"],
    "//0": "MinSerial and MaxSerial are set to exclude some of the certs specified below, to exercise serial number checking.",
    "MinSerial": {"Log": 1, "Index": 8},
    "MaxSerial": {"Log": 1, "Index": 4096}
  },
  "Entries": [
    {
      "Repeat": 2,
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["a.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"]
    },
    {
      "//0": "This cert is invalid because it falls under minSerial for the CA.",
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["z.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"],
      "Certificates": [
        {"SubtreeStart": 0, "SubtreeEnd": 4, "Cosigners": ["32473.1"]}
      ]
    },
    {
      "Repeat": 7,
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["a.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"]
    },
    {
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["b.example", "*.blah.b.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"],
      "Checkpoints": ["fast"],
      "Certificates": [
        {"Checkpoint": "fast", "Cosigners": ["32473.1", "32473.2.1", "32473.2.2"]},
        {"SubtreeStart": 8, "SubtreeEnd": 16, "Cosigners": ["32473.1", "32473.2.2"]}
      ]
    },
    {
      "Null": true
    },
    {
      "Repeat": 10,
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["c.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"]
    },
    {
      "Repeat": 10,
      "Null": true
    },
    {
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "Subject": {"CommonName": "No extensions and a common name"},
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "Certificates": [
        {"Checkpoint": "fast", "Cosigners": ["32473.1", "32473.2.1", "32473.2.2"]}
      ]
    },
    {
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["d.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"],
      "Checkpoints": ["fast"],
      "//0": "Only the first two certs specified below are valid. The rest exercise various error cases.",
      "Certificates": [
        {"Checkpoint": "fast", "Cosigners": ["32473.1", "32473.2.1", "32473.2.2"]},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"]},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"], "BitFlipProof": true},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"], "UnusedBit": true},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.2.2"]},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.2.2", "32473.1"], "DontSortCosigners": true},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1", "32473.1", "32473.2.2"], "DontSortCosigners": true},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1", "32473.2.2", "32473.2.2"], "DontSortCosigners": true},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"], "OverrideSignatureAlgorithm": "MAsGCWCGSAFlAwQDEQ=="},
        {"SubtreeStart": 32, "SubtreeEnd": 64, "Cosigners": ["32473.1"], "OverrideTBSSignatureAlgorithm": "MAsGCWCGSAFlAwQDEQ=="}
      ]
    },
    {
      "Repeat": 2000,
      "Subject": {"CommonName": "Some more filler certificates"},
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z"
    },
    {
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "Subject": {
        "CommonName": "https://github.com/ietf-plants-wg/merkle-tree-certs/issues/146"
      },
      "DNSNames": ["e.example"],
      "KeyUsage": ["CertSign"],
      "IsCA": true,
      "MaxPathLen": 5,
      "Certificates": [
        {"Checkpoint": "fast", "Cosigners": ["32473.1", "32473.2.1", "32473.2.2"]}
      ]
    },
    {
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["e.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"],
      "Checkpoints": ["fast"],
      "Certificates": [
        {"Checkpoint": "fast", "Cosigners": ["32473.1", "32473.2.1", "32473.2.2"]}
      ]
    },
    {
      "Repeat": 3000,
      "Subject": {"CommonName": "Some more filler certificates"},
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z"
    },
    {
      "//0": "This cert is invalid because it falls above maxSerial for the CA.",
      "PublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyxiC16lts+SOL87OwHhGDzK9/dyUd7sM80jAf53VL+AV38HoHKpmA7LJoYLf4yVhcVleNcxufsAfcPueTLX0Vg==",
      "NotBefore": "2020-01-01T00:00:00Z",
      "NotAfter": "2030-12-31T23:59:59Z",
      "DNSNames": ["f.example"],
      "KeyUsage": ["DigitalSignature"],
      "ExtKeyUsage": ["ServerAuth"],
      "Checkpoints": ["fast"],
      "Certificates": [
        {"Checkpoint": "fast", "Cosigners": ["32473.1"]}
      ]
    }
  ]
}