{ "formatVersion": 1, "scope": "Sanitized public TLS evidence and documentation commands only; no fiscal transmission or truststore correction performed by this audit.", "createdOnUtcDate": "2026-10-17", "realA1PasswordOrPrivateFiscalFilesRead": false, "truststoreRuntimeServicesOrNodeProcessesChanged": false, "newSefazNetworkCalls": false, "newPublicNetworkReads": [ "ITI repository HTML", "ITI public root certificate", "Ubuntu, Debian and OpenSSL documentation" ], "officialRoot": { "repositoryUrl": "https://www.gov.br/iti/pt-br/assuntos/repositorio/repositorio-ac-raiz", "repositoryLabel": "Certificado da AC Raiz da ICP-Brasil v10 - SSL", "certificateUrl": "https://acraiz.icpbrasil.gov.br/credenciadas/RAIZ/ICP-Brasilv10.crt", "downloadVerifiedThisAudit": true, "localPublicCopy": "evidence/tls-public/iti-root-v10-public.crt", "downloadEncoding": "PEM", "downloadBytes": 2374, "downloadFileSha256": "3b3ef39649ba13e10a99bc042cfc112723d8e0503326174f15ab89941a0f33e0", "certificateDerSha256Fingerprint": "6e0bff069a26994c15de2c4888cc54af84882e5495b7fbf66be9ccffec7489f6", "fileHashAndCertificateFingerprintAreDifferentQuantities": true, "subjectAndIssuerCn": "Autoridade Certificadora Raiz Brasileira v10", "notBeforeUtc": "2019-07-01T19:15:59Z", "notAfterUtc": "2032-07-01T12:00:59Z", "matchesPreviouslyPreservedPePresentedRootDer": true, "fingerprintMethodThisAudit": "SHA256 of X509Certificate2.RawData after downloading official PEM, using host .NET; no certificate installation.", "independentReproductionCommand": "openssl x509 -in ICP-Brasilv10.crt -noout -fingerprint -sha256" }, "historicalPublicProbes": { "beforeUtc": "2026-10-16T23:48:15Z", "afterUtc": "2026-10-16T23:56:07Z", "effectiveCaBundle": "/etc/ssl/certs/ca-certificates.crt", "before": { "approvedRootPresent": false, "caCount": 121, "bundleSha256": "ecd9dc38bc3efb7dbd6431f57e29d2f8d6a0f0d211e1464b3fef2cbfe266fcd2", "systemAndRuntimeOpenSslExit": 1, "verificationError": "19: self-signed certificate in certificate chain", "curlExit": 60, "offlinePresentedIntermediateAndOfficialRootWithHostnamePurposeTimeValidationPassed": true }, "previouslyAuthorizedCorrection": { "appliedUtc": "2026-10-16T23:56:05Z", "onlyApprovedRootAdded": true, "allPreviousCaCertificatesPreserved": true, "added": 1, "removed": 0, "runtimeAndTlsVerificationUnchanged": true, "servicesAndWslNotRestarted": true }, "after": { "caCount": 122, "bundleSha256": "fb4353495f983953387faf11c9f4fb4270052668d02a9c6be4093a4683e2c78e", "systemAndRuntimeOpenSslExit": 0, "verifyReturnCode": 0, "tls": "1.2", "hostnameSniChainPurposeAndValidityVerified": true, "curlExit": 0, "httpStatusWithoutClientCertificate": 403 }, "noClientCertificateOrFiscalPayloadUsed": true, "isolatedVerifyReturnCodeLineIsNotSufficient": true, "http403IsNotFiscalAuthorization": true, "archivedPeIntermediateDidNotMatchPresentedIntermediate": true, "doNotReplacePresentedChainWithArchivedIntermediate": true }, "causalityLimits": { "proven": "Missing V10 trust anchor blocked the historical public TLS probes; adding only that approved root corrected those probes with the same runtime/TLS settings.", "historicalApplicationFailureCauseProvenByPublicProbe": false, "discardedExceptionAndRetWsNotRecovered": true, "documentationRule": "A public TLS probe proves its own trust result. It does not establish the cause or delivery outcome of an earlier application operation when its original exception/RetWS was discarded." }, "platformAndRuntimeVersions": { "verifiedPlatform": "Linux x86-64 glibc, Ubuntu 24.04 under WSL", "historicallyExecutedPublicProbeRuntime": "0.1.2", "historicalSystemOpenSsl": "OpenSSL 3.0.13 30 Jan 2024", "historicalRuntimeLibraryOpenSsl": "OpenSSL 3.0.13 30 Jan 2024", "runtimeLibsslPackage": "libssl3t64:amd64 3.0.13-0ubuntu3.16", "acbrSourceRevision": 48590, "freePascal": "3.2.2", "lazarus": "3.0", "workerSeparateSemanticVersion": null, "worker012Sha256": "5cf11071f8b06e5ee05dd9ef114a9b7f7060949e5a0836728390b4ae4a67db68", "worker020And021Sha256": "210c2a96339017579c7c81faa3f755b386e47475ea4e2c9ba7108fb577326c65", "runtime021ManifestSha256": "d7e0bb150982daa3670d1ee8d6a1e0e1e422b2e213bc03c6ea8828ffea659414", "runtime021ArchiveSha256": "029e23b5fc05e0886a9e988300ef46811db0705f687109d114d34e87500d1b5f", "runtime021FilesVerifiedByExistingPublicAudit": 264, "runtime020To021Delta": "252 files unchanged; 12 license files added; no changed or removed files.", "tlsAndOpenSslLibraries012020021ByteIdentical": true, "newPublicProbeUsing021Performed": false, "windowsAndMacosWorkerOpenSslVersions": "Not verified; do not infer from source conditional compilation or host SDK language.", "hostLanguageOpenSslSettingsAutomaticallyConfigureNativeWorker": false }, "nativeTls": { "stack": "Synapse httpOpenSSL", "linuxSelectedCaFile": "/etc/ssl/certs/ca-certificates.crt", "verifyCert": true, "hostnameCheck": "X509_check_host plus GetVerifyCert=0", "tlsVersion": "LT_TLSv1_2", "allowUnsafeLegacyRenegotiation": false, "nativeTlsSha256": "6ac719f1d034149085c088f436419c3329e39437b63a150971d5b44059294061", "libsslSo3Sha256": "a40e7b67489bbd257e432c700ff8f6a1ad796425b5eccecdc2930127fdd86624", "libcryptoSo3Sha256": "6866ed711dab8927e1bf82bf1cd30e828bdfc34f3cc1e83b1c9eb01ce6c37d9a" }, "originalReturnLimits": { "available": "Final native worker frame via PHP FiscalResult::data(), and returned/composed XML when present; consumer preserves such output privately.", "rawSoapOrFullAcbrRetWsExportedByRuntime020021": false, "newNativeDiagnosticsSourceOrRetWsAdditionIn021": false, "applicationInputIsNotProofOfServerResponse": true, "discardedExceptionOrRetWsCannotBeRecoveredFromPublicEvidence": true, "transportMayDiscardFrameOnSubsequentExitPipeOrSequenceFailure": true, "noPrivateFrameOrXmlCopiedIntoThisReport": true }, "commands": { "status": "Documented only. No diagnostics against SEFAZ or corrections executed by this audit. Future installation is conditional on the same diagnosed missing approved root; existing WSL was already corrected historically.", "diagnostics": [ "date -u", "openssl version -a", "dpkg-query -W openssl ca-certificates", "sha256sum /etc/ssl/certs/ca-certificates.crt", "openssl x509 -in ICP-Brasilv10.crt -noout -subject -issuer -dates -fingerprint -sha256", "openssl verify -check_ss_sig -CAfile ICP-Brasilv10.crt ICP-Brasilv10.crt", "timeout 20 openssl s_client -brief -connect nfehomolog.sefaz.pe.gov.br:443 -servername nfehomolog.sefaz.pe.gov.br -tls1_2 -verify_return_error -verify_hostname nfehomolog.sefaz.pe.gov.br -CAfile /etc/ssl/certs/ca-certificates.crt