{
  "kind": "FRESH_PRIMARY_CT_MATCH_TO_PREVIOUSLY_RETAINED_TLS_CERTIFICATE",
  "checkedUTC": "2026-10-31T14:14:54.059126+00:00",
  "freshSource": {
    "name": "certspotter-exact-domain",
    "URL": "https://api.certspotter.com/v1/issuances?domain=debugbear.com&expand=dns_names&expand=issuer&expand=cert_der",
    "UTC": "2026-10-31T14:05:51.230178+00:00",
    "HTTP": 200,
    "finalURL": "https://api.certspotter.com/v1/issuances?domain=debugbear.com&expand=dns_names&expand=issuer&expand=cert_der",
    "bytes": 26671,
    "SHA256": "8ef45350407189dfb9b965ffb2a9d85143c338506f7b4898db2823dcb70f14ed",
    "source": "raw/certspotter-exact-domain.source"
  },
  "sourceScope": "One documented exact-domain query, include_subdomains defaultfalse,14 unexpired issuance entries returned. Not an exhaustive historical certificate or DNS dataset.",
  "verifiedLeafFields": {
    "DER_SHA256": "684bf11322b411cd14bf2de9192ea0bb0702cc6cbcf2c79febc30267f37fdae2",
    "SPKI_SHA256": "f557256ddbca032685047695cb138b23a825f944e713bc35b94c16bdd7ad70f8",
    "serialHex": "54696c2277db59840bc457f9be8c8ead226",
    "notBefore": "2026-10-29T17:09:32Z",
    "notAfter": "2027-01-27T17:09:31Z",
    "DNSNames": [
      "*.debugbear.com",
      "debugbear.com"
    ],
    "issuer": "CN=YE1,O=Let's Encrypt,C=US",
    "embeddedSCTs": [
      {
        "timestamp": "2026-10-29T18:08:03.080000Z",
        "logID": "604c9aaf7a7f775f01d406fc920dc899eb0b1c7df8c9521bfafa17773b978bc9"
      },
      {
        "timestamp": "2026-10-29T18:08:04.701000Z",
        "logID": "1a8b9d6b8dd791d1cd0549edb60355d606b64fad30db71fe788f0fc7c8fbc4b1"
      }
    ]
  },
  "chainCapsules": [
    "capsules/issuer-ye1.pem",
    "capsules/root-ye-by-x2.pem",
    "capsules/root-x2.pem"
  ],
  "capsuleHashes": {
    "capsules/root-x2.pem": "a13d881e11fe6df181b53841f9fa738a2d7ca9ae7be3d53c866f722b4242b013",
    "capsules/root-ye-by-x2.pem": "2681e97e939cab7cde4fad1dc733fc7c99e39a203190e8f298e1c02ab431b1e9",
    "capsules/leaf.pem": "6054afa78e9018c4256f81b548a2b1dd50830c9df00d75b208003008e907b550",
    "capsules/issuer-ye1.pem": "30028f6eecdb9ba45b1a2440187278be1bc08c360da6611f21b4b3e74b103981"
  },
  "sourceReportedIssuer": {
    "friendly_name": "Let's Encrypt",
    "pubkey_sha256": "6ebcefb4210b088654a38b03fea3d7d1c711b4fb1ddc363a45f9b1a4e53da01e",
    "name": "C=US, O=Let's Encrypt, CN=YE1"
  },
  "sourceReportedRevoked": false,
  "retainedTLSArtifact": {
    "path": "evidence/infra-followup/cdn-tls-leaf.pem",
    "PEM_SHA256": "6054afa78e9018c4256f81b548a2b1dd50830c9df00d75b208003008e907b550",
    "DERBytesEqualFreshCT": true,
    "sourceSummary": "evidence/infra-followup/infrastructure-summary.json",
    "summarySHA256": "f401f2e2833751f9049ab410b63492d9bda1313bb816bac6643c37631042f034",
    "summaryRecordedCaptureRange": "2026-10-29T18:26:45Z to2026-10-29T18:30:35Z",
    "boundary": "Previous capture, not a new connection. Filesystem mtime is not used to authenticate a remote observation."
  },
  "additionalReturnedEntry": {
    "id": "18075194461",
    "cert_sha256": "51ded217ebb0b86b2f45e963c4576a62a523b3f13a5894b013dbe153073c7d62",
    "pubkey_sha256": "66f53860f6ffba961918aa400a86f680e6b6128f96b34ef51cc5482a47d0e882",
    "dns_names": [
      "*.debugbear.com",
      "debugbear.com"
    ],
    "not_before": "2026-10-30T17:49:40Z",
    "not_after": "2027-01-27T19:09:48Z",
    "issuer": {
      "friendly_name": "SSL.com",
      "pubkey_sha256": "1959e38fb7d3fc16bee5e20e834e2c6667bf0e9e6b9806b86bd40a6d66c716d0",
      "name": "C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 4"
    }
  },
  "additionalEntryKind": "The October30Cloudflare entry DER contains CTpoison and is a precertificate, not a newly observed served TLS leaf.",
  "criticalTimeDistinction": "17:09:32UTC is X.509 notBefore. The embedded SCT timestamps are18:08:03.080UTC and18:08:04.701UTC. notBefore is not an issuance, CT-observation, DNS-change or attack-start timestamp.",
  "actorLimit": "Certificate/public-key correspondence and signature validity do not identify who requested, controlled or deployed the certificate, or a Car/common-human relationship.",
  "verificationScope": "Offline field/hash decoding and signature chain leaf→YE1→RootYE→ISRGRootX2, with officialLet’sEncrypt certificate files. No SCT-log signature, revocation or historical browser trust-store validation."
}