<ConstraintsParameters Name="Certificate policy TL based" xmlns="http://dss.esig.europa.eu/validation/policy">
    <Description>Validates electronic attestation of attributes presentations and indicates its qualification status
        at issuance and validation time. All certificates and their related chains are validated against
        the EU Member State Trusted Lists (this includes target certificate and certificates used to validate
        certificate validity status services - CRLs, OCSP).
    </Description>
    <SignatureConstraints>
        <StructuralValidation Level="WARN" />
        <AcceptablePolicies Level="FAIL">
            <Id>ANY_POLICY</Id>
            <Id>NO_POLICY</Id>
        </AcceptablePolicies>
        <PolicyAvailable Level="INFORM" />
        <PolicyHashMatch Level="WARN" />
        <AcceptableFormats Level="FAIL">
            <Id>CB-AdES</Id>
            <Id>CB-AdES-BASELINE-B</Id>
            <Id>JAdES</Id>
            <Id>JAdES-BASELINE-B</Id>
        </AcceptableFormats>
        <BasicSignatureConstraints>
            <ReferenceDataExistence Level="FAIL" />
            <ReferenceDataIntact Level="FAIL" />
            <ReferenceDataNameMatch Level="WARN" />
            <SignatureIntact Level="FAIL" />
            <SignatureDuplicated Level="FAIL" />
            <ProspectiveCertificateChain Level="FAIL" />
            <SigningCertificate>
                <Recognition Level="FAIL" />
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <AuthorityInfoAccessPresent Level="WARN" />
                <RevocationDataSkip Level="INFORM">
                    <CertificateExtensions>
                        <Id>0.4.0.194121.2.1</Id> <!-- valassured-ST-certs -->
                        <Id>2.5.29.56</Id> <!-- noRevAvail -->
                    </CertificateExtensions>
                </RevocationDataSkip>
                <RevocationInfoAccessPresent Level="WARN" />
                <RevocationDataAvailable Level="FAIL" />
                <AcceptableRevocationDataFound Level="FAIL" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <KeyUsage Level="WARN">
                    <Id>nonRepudiation</Id>
                </KeyUsage>
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <NoRevAvail Level="WARN" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <SerialNumberPresent Level="WARN" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <RevocationIssuerNotExpired Level="FAIL" />
                <NotSelfSigned Level="WARN" />
                <UsePseudonym Level="INFORM" />
                <Cryptographic />
            </SigningCertificate>
            <CACertificate>
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <RevocationDataAvailable Level="FAIL" />
                <AcceptableRevocationDataFound Level="FAIL" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <CA Level="FAIL" />
                <MaxPathLength Level="FAIL" />
                <KeyUsage Level="FAIL">
                    <Id>keyCertSign</Id>
                </KeyUsage>
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <SubjectKeyIdentifierPresent Level="FAIL" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    <Id>2.5.29.56</Id> <!-- noRevAvail -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <Cryptographic />
            </CACertificate>
            <Cryptographic />
        </BasicSignatureConstraints>
        <SignedAttributes>
            <SigningCertificatePresent Level="FAIL" />
            <UnicitySigningCertificate Level="WARN" />
            <SigningCertificateRefersCertificateChain Level="WARN" />
            <SigningCertificateDigestAlgorithm Level="WARN" />
            <CertDigestPresent Level="FAIL" />
            <CertDigestMatch Level="FAIL" />
            <IssuerSerialMatch Level="WARN" />
            <KeyIdentifierMatch Level="WARN" />
            <SigningTime Level="WARN" />
            <SigningTimeInCertRange Level="FAIL" />
            <SignatureType Level="WARN">
                <Id>dc+sd-jwt</Id>
            </SignatureType>
            <EllipticCurveKeySize Level="WARN" />
        </SignedAttributes>
    </SignatureConstraints>
    <KeyBindingSignatureConstraints>
        <AcceptablePolicies Level="FAIL">
            <Id>ANY_POLICY</Id>
            <Id>NO_POLICY</Id>
        </AcceptablePolicies>
        <PolicyAvailable Level="INFORM" />
        <PolicyHashMatch Level="WARN" />
        <AcceptableFormats Level="FAIL">
            <Id>*</Id>
        </AcceptableFormats>
        <BasicSignatureConstraints>
            <ReferenceDataExistence Level="FAIL" />
            <ReferenceDataIntact Level="FAIL" />
            <ReferenceDataNameMatch Level="WARN" />
            <SignatureIntact Level="FAIL" />
            <SignatureDuplicated Level="FAIL" />
            <ProspectiveCertificateChain Level="WARN" />
            <SigningCertificate>
                <Recognition Level="WARN" />
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <AuthorityInfoAccessPresent Level="WARN" />
                <RevocationDataSkip Level="INFORM">
                    <CertificateExtensions>
                        <Id>0.4.0.194121.2.1</Id> <!-- valassured-ST-certs -->
                        <Id>2.5.29.56</Id> <!-- noRevAvail -->
                    </CertificateExtensions>
                </RevocationDataSkip>
                <RevocationInfoAccessPresent Level="WARN" />
                <RevocationDataAvailable Level="WARN" />
                <AcceptableRevocationDataFound Level="WARN" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <KeyUsage Level="WARN">
                    <Id>nonRepudiation</Id>
                </KeyUsage>
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <NoRevAvail Level="INFORM" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <SerialNumberPresent Level="WARN" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <RevocationIssuerNotExpired Level="WARN" />
                <NotSelfSigned Level="WARN" />
                <UsePseudonym Level="INFORM" />
                <Cryptographic />
            </SigningCertificate>
            <CACertificate>
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <RevocationDataAvailable Level="WARN" />
                <AcceptableRevocationDataFound Level="WARN" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <CA Level="FAIL" />
                <MaxPathLength Level="FAIL" />
                <KeyUsage Level="FAIL">
                    <Id>keyCertSign</Id>
                </KeyUsage>
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <SubjectKeyIdentifierPresent Level="FAIL" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    <Id>2.5.29.56</Id> <!-- noRevAvail -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <Cryptographic />
            </CACertificate>
            <Cryptographic />
        </BasicSignatureConstraints>
        <SignedAttributes>
            <SigningCertificateDigestAlgorithm Level="WARN" />
            <CertDigestMatch Level="FAIL" />
            <IssuerSerialMatch Level="WARN" />
            <KeyIdentifierMatch Level="WARN" />
            <SigningTime Level="WARN" />
            <SigningTimeInCertRange Level="FAIL" />
            <EllipticCurveKeySize Level="WARN" />
        </SignedAttributes>
    </KeyBindingSignatureConstraints>
    <Revocation>
        <UnknownStatus Level="FAIL" />
        <ThisUpdatePresent Level="FAIL" />
        <RevocationIssuerKnown Level="FAIL" />
        <RevocationIssuerValidAtProductionTime Level="FAIL" />
        <RevocationAfterCertificateIssuance Level="FAIL" />
        <RevocationHasInformationAboutCertificate Level="FAIL" />
        <SelfIssuedOCSP Level="WARN" />
        <BasicSignatureConstraints>
            <ReferenceDataExistence Level="FAIL" />
            <ReferenceDataIntact Level="FAIL" />
            <SignatureIntact Level="FAIL" />
            <ProspectiveCertificateChain Level="FAIL" />
            <SigningCertificate>
                <Recognition Level="FAIL" />
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <RevocationDataSkip Level="IGNORE">
                    <CertificateExtensions>
                        <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    </CertificateExtensions>
                </RevocationDataSkip>
                <RevocationDataAvailable Level="FAIL" />
                <AcceptableRevocationDataFound Level="FAIL" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <IssuerName Level="FAIL" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <Cryptographic />
            </SigningCertificate>
            <CACertificate>
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <RevocationDataAvailable Level="WARN" />
                <AcceptableRevocationDataFound Level="WARN" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <KeyUsage Level="FAIL">
                    <Id>keyCertSign</Id>
                </KeyUsage>
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
				<SubjectKeyIdentifierPresent Level="FAIL" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    <Id>2.5.29.56</Id> <!-- noRevAvail -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <Cryptographic />
            </CACertificate>
            <Cryptographic />
        </BasicSignatureConstraints>
    </Revocation>
    <EAA>
        <EAASignatureUnicity Level="FAIL" />
        <EAASignatureValid Level="FAIL" />
        <DisclosurePresent Level="WARN" />
        <DisclosureFound Level="FAIL" />
        <DisclosureIntact Level="FAIL" />
        <KeyBindingSignaturePresent Level="WARN" />
        <KeyBindingSignatureValid Level="FAIL" />
        <ETSI194721Conformance Level="WARN" />
        <EAAType Level="WARN">
            <Id>*</Id>
        </EAAType>
        <EAATypeIntegrityPresent Level="WARN" />
        <EAAIssuanceDatePresent Level="FAIL" />
        <EAANotBeforePresent Level="FAIL" />
        <EAAExpirationPresent Level="FAIL" />
        <EAANotExpired Level="FAIL" />
        <EAAAdministrativePeriodNotExpired Level="WARN" />
        <EAAOneTimeUse Level="INFORM" />
        <EAAShortLived Level="INFORM" />
        <EAARevocationPresent Level="WARN" />
        <EAARevocationAvailable Level="FAIL" />
        <AcceptableEAARevocationFound Level="FAIL" />
        <NotRevoked Level="FAIL" />
        <NotOnHold Level="FAIL" />
        <EAAUsePseudonym Level="INFORM" />
    </EAA>
    <EAARevocation>
        <Type Level="FAIL">
            <Id>*</Id>
        </Type>
        <UnknownStatus Level="FAIL" />
        <IssuanceTime Level="FAIL" />
        <ExpirationTime Level="FAIL" />
        <NotExpired Level="FAIL" />
        <Subject Level="FAIL">
            <Id>*</Id>
        </Subject>
        <SubjectMatch Level="FAIL" />
        <IssuerValidAtIssuanceTime Level="FAIL" />
        <BasicSignatureConstraints>
            <ReferenceDataExistence Level="FAIL" />
            <ReferenceDataIntact Level="FAIL" />
            <SignatureIntact Level="FAIL" />
            <ProspectiveCertificateChain Level="FAIL" />
            <SigningCertificate>
                <Recognition Level="FAIL" />
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <RevocationDataSkip Level="IGNORE">
                    <CertificateExtensions>
                        <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    </CertificateExtensions>
                </RevocationDataSkip>
                <RevocationDataAvailable Level="FAIL" />
                <AcceptableRevocationDataFound Level="FAIL" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <Cryptographic />
            </SigningCertificate>
            <CACertificate>
                <Signature Level="FAIL" />
                <NotExpired Level="FAIL" />
                <SunsetDate Level="FAIL" />
                <RevocationDataAvailable Level="WARN" />
                <AcceptableRevocationDataFound Level="WARN" />
                <CRLNextUpdatePresent Level="WARN" />
                <RevocationFreshness Level="IGNORE" Unit="DAYS" Value="0" />
                <KeyUsage Level="FAIL">
                    <Id>keyCertSign</Id>
                </KeyUsage>
                <PolicyTree Level="WARN" />
                <NameConstraints Level="WARN" />
                <AuthorityKeyIdentifierPresent Level="WARN" />
                <SubjectKeyIdentifierPresent Level="FAIL" />
                <SupportedCriticalExtensions Level="WARN">
                    <Id>2.5.29.15</Id> <!-- keyUsage -->
                    <Id>2.5.29.32</Id> <!-- certificatePolicies -->
                    <Id>2.5.29.17</Id> <!-- subjectAlternativeName -->
                    <Id>2.5.29.19</Id> <!-- basicConstraints -->
                    <Id>2.5.29.30</Id> <!-- nameConstraints -->
                    <Id>2.5.29.36</Id> <!-- policyConstraints -->
                    <Id>2.5.29.37</Id> <!-- extendedKeyUsage -->
                    <Id>2.5.29.31</Id> <!-- CRLDistributionPoints -->
                    <Id>2.5.29.54</Id> <!-- inhibitAnyPolicy -->
                    <Id>1.3.6.1.5.5.7.1.3</Id> <!-- QCStatements -->
                    <!-- policyMappings 2.5.29.33 not supported -->
                </SupportedCriticalExtensions>
                <ForbiddenExtensions Level="FAIL">
                    <Id>1.3.6.1.5.5.7.48.1.5</Id> <!-- ocsp_noCheck -->
                    <Id>2.5.29.56</Id> <!-- noRevAvail -->
                </ForbiddenExtensions>
                <IssuerName Level="FAIL" />
                <NotRevoked Level="FAIL" />
                <NotOnHold Level="FAIL" />
                <Cryptographic />
            </CACertificate>
            <Cryptographic />
        </BasicSignatureConstraints>
    </EAARevocation>
    <Cryptographic Level="FAIL">
        <AcceptableEncryptionAlgo>
            <Algo>RSA</Algo>
            <Algo>RSASSA-PSS</Algo>
            <Algo>DSA</Algo>
            <Algo>ECDSA</Algo>
            <Algo>PLAIN-ECDSA</Algo>
            <!-- 		<Algo>EdDSA</Algo> 				Not referenced in ETSI/SOGIS -->
        </AcceptableEncryptionAlgo>
        <MiniPublicKeySize>
            <Algo Size="1024">DSA</Algo>
            <Algo Size="786">RSA</Algo>
            <Algo Size="786">RSASSA-PSS</Algo>
            <Algo Size="160">ECDSA</Algo>
            <Algo Size="160">PLAIN-ECDSA</Algo>
            <!-- 		<Algo Size="24">EdDSA</Algo> 		Not referenced in ETSI/SOGIS -->
        </MiniPublicKeySize>
        <AcceptableDigestAlgo>
            <!--		<Algo>MD2</Algo> 		Not referenced in ETSI/SOGIS -->
            <Algo>MD5</Algo>
            <Algo>SHA1</Algo>
            <Algo>SHA224</Algo>
            <Algo>SHA256</Algo>
            <Algo>SHA384</Algo>
            <Algo>SHA512</Algo>
            <!--		<Algo>SHA3-224</Algo> 		Not referenced in ETSI/SOGIS -->
            <Algo>SHA3-256</Algo>
            <Algo>SHA3-384</Algo>
            <Algo>SHA3-512</Algo>
            <Algo>RIPEMD160</Algo>
            <Algo>WHIRLPOOL</Algo>
        </AcceptableDigestAlgo>
        <AlgoExpirationDate Level="FAIL" Format="yyyy-MM-dd" UpdateDate="2025-01-01" LevelAfterUpdate="WARN">
            <!-- Digest algorithms -->
            <Algo Date="2004-08-01">MD5</Algo> <!-- ETSI TS 102 176-1 (Historical) V2.1.1 -->
            <Algo Date="2012-08-01">SHA1</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2029-01-01">SHA224</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo>SHA256</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo>SHA384</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo>SHA512</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo>SHA3-256</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo>SHA3-384</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo>SHA3-512</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo Date="2014-08-01">RIPEMD160</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2020-12-01">WHIRLPOOL</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <!-- end Digest algorithms -->
            <!-- Encryption algorithms -->
            <Algo Date="2015-12-01" Size="1024">DSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2029-01-01" Size="1900">DSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Size="3000">DSA</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo Date="2010-08-01" Size="786">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2019-10-01" Size="1024">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2019-10-01" Size="1536">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2029-01-01" Size="1900">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2029-01-01" Size="3000">RSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2010-08-01" Size="786">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2019-10-01" Size="1024">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2019-10-01" Size="1536">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2029-01-01" Size="1900">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Size="3000">RSASSA-PSS</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo Date="2012-08-01" Size="160">ECDSA</Algo> <!-- ETSI TS 102 176-1 (Historical) V2.1.1 -->
            <Algo Date="2012-08-01" Size="163">ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2021-10-01" Size="224">ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Size="256">ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <Algo Date="2012-08-01" Size="160">PLAIN-ECDSA</Algo> <!-- ETSI TS 102 176-1 (Historical) V2.1.1 -->
            <Algo Date="2012-08-01" Size="163">PLAIN-ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Date="2021-10-01" Size="224">PLAIN-ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 -->
            <Algo Size="256">PLAIN-ECDSA</Algo> <!-- ETSI TS 119 312 v1.5.1 --> <!-- R -->
            <!-- end Encryption algorithms -->
        </AlgoExpirationDate>
    </Cryptographic>

    <Model Value="SHELL" />

    <!-- eIDAS REGL 910/EU/2014 -->
    <eIDAS>
        <TLFreshness Level="WARN" Unit="HOURS" Value="6" />
        <TLNotExpired Level="WARN" />
        <TLWellSigned Level="WARN" />
        <TLVersion Level="FAIL">
            <Id>5</Id>
            <Id>6</Id>
        </TLVersion>
        <TLStructure Level="WARN" />
    </eIDAS>
</ConstraintsParameters>
