Skip to content

Update CA bundle path compatibility - #412

Merged
mitch292 merged 1 commit into
cloudflare:masterfrom
aberglund-cf:fix/epki-cross-sign-loop
Oct 20, 2026
Merged

mitch292 merged 1 commit into
cloudflare:masterfrom
aberglund-cf:fix/epki-cross-sign-loop

Conversation

@aberglund-cf

@aberglund-cf aberglund-cf commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Context

Follow-up to merged #411, rebased onto current master. This PR now contains only the CA bundle path compatibility update.

Summary

  • Remove two obsolete cross-signed ePKI CA certificates from the current intermediate bundle.
  • Retain both self-signed roots and all three reverse-direction cross-signs for compatibility.
  • Preserve historical release membership and regenerate bundle artifacts.
  • Add regression coverage for root retention and cross-sign path compatibility.

Validation

  • go test ./... -count=1
  • go vet ./...
  • git diff --check
  • Matched the two removals against source certificate bytes and database identities.
  • Verified all other intermediate certificates retain their bytes and ordering; root bundle is unchanged from Update CA trust store #411.
  • Verified only two current-release membership rows change; historical memberships, certificate records, revocations, and other tables remain unchanged.
  • Verified historical and current bundle regeneration, SQLite integrity, and a subsequent release roll on a database copy.
  • Chain-order graph check resolves all ePKI-related order dependencies without changing unrelated findings.

Remove two obsolete cross-signed CA certificates from the current
intermediate bundle while retaining both self-signed roots and
reverse-direction cross-signs. Preserve historical bundle snapshots
and add regression coverage.

Validation: go test ./... -count=1 and go vet ./...
@aberglund-cf
aberglund-cf force-pushed the fix/epki-cross-sign-loop branch from 7f4cfb8 to 324279c Compare October 20, 2026 20:21
@mitch292
mitch292 merged commit 88f299d into cloudflare:master Oct 20, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants