Update CA bundle path compatibility

certdata/epki_cross_sign_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"bytes"
+	"crypto/x509"
+	"slices"
+	"testing"
+)
+
+// Cross-signs must provide paths to the older root without allowing issuer
+// selection to cycle between the older root and G2.
+func TestEPKICrossSignsDoNotFormLoop(t *testing.T) {
+	var older, g2 *x509.Certificate
+	for _, cert := range loadBundle(t, caBundleFile) {
+		// Trust anchors do not depend on their historical self-signature algorithm.
+		if !cert.IsCA || !bytes.Equal(cert.RawSubject, cert.RawIssuer) {
+			continue
+		}
+		if slices.Contains(cert.Subject.OrganizationalUnit, "ePKI Root Certification Authority") {
+			older = cert
+		}
+		if cert.Subject.CommonName == "ePKI Root Certification Authority - G2" {
+			g2 = cert
+		}
+	}
+	if older == nil || g2 == nil {
+		t.Fatal("both self-signed ePKI roots must remain in the root bundle")
+	}
+
+	reverseCrossSigns := 0
+	for _, cert := range loadBundle(t, intBundleFile) {
+		if bytes.Equal(cert.RawSubject, older.RawSubject) && bytes.Equal(cert.RawIssuer, g2.RawSubject) {
+			t.Errorf("older ePKI root issued by G2 can form a loop (serial %X)", cert.SerialNumber)
+		}
+		if bytes.Equal(cert.RawSubject, g2.RawSubject) && bytes.Equal(cert.RawIssuer, older.RawSubject) {
+			if !bytes.Equal(cert.RawSubjectPublicKeyInfo, g2.RawSubjectPublicKeyInfo) {
+				t.Error("ePKI G2 cross-sign does not share the retained G2 root's key")
+			}
+			if err := cert.CheckSignatureFrom(older); err != nil {
+				t.Errorf("ePKI G2 cross-sign cannot terminate at the older root: %v", err)
+			}
+			reverseCrossSigns++
+		}
+	}
+	if reverseCrossSigns == 0 {
+		t.Error("missing ePKI G2 cross-signs supporting clients that trust only the older root")
+	}
+}

certdata/int-bundle.txt

@@ -3505,46 +3505,6 @@ Details:
 	OCSP server:
 		- http://uniper-group-ca-2-2015.ocsp.d-trust.net
 CERTIFICATE
-Subject: /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification
-    Authority
-Issuer: /ePKI Root Certification Authority - G2/C=TW/O=Chunghwa Telecom Co.,
-    Ltd.
-	Signature algorithm: RSA / SHA256
-Details:
-	Public key: RSA-4096
-	Serial number: 7083007561045021846628119216699988972
-	AKI: 72:5B:BA:AA:72:38:EE:25:90:24:B5:94:22:FA:09:88:CA:8B:0A:FB
-	SKI: 1E:0C:F7:B6:67:F2:E1:92:26:09:45:C0:55:39:2E:77:3F:42:4A:A2
-	Valid from: 2015-11-17T08:31:41+0000
-	     until: 2034-12-20T02:31:27+0000
-	Key usages: cert sign, crl sign
-	Basic constraints: valid, is a CA certificate
-	SANs (0):
-	1 AIA:
-		http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b
-	OCSP server:
-		- http://ocsp.eca.hinet.net/OCSP/ocspG2sha2
-CERTIFICATE
-Subject: /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification
-    Authority
-Issuer: /ePKI Root Certification Authority - G2/C=TW/O=Chunghwa Telecom Co.,
-    Ltd.
-	Signature algorithm: RSA / SHA256
-Details:
-	Public key: RSA-4096
-	Serial number: 269677336687240111117627827670483958575
-	AKI: 72:5B:BA:AA:72:38:EE:25:90:24:B5:94:22:FA:09:88:CA:8B:0A:FB
-	SKI: 1E:0C:F7:B6:67:F2:E1:92:26:09:45:C0:55:39:2E:77:3F:42:4A:A2
-	Valid from: 2015-11-17T08:31:41+0000
-	     until: 2034-12-20T02:31:27+0000
-	Key usages: cert sign, crl sign
-	Basic constraints: valid, is a CA certificate
-	SANs (0):
-	1 AIA:
-		http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b
-	OCSP server:
-		- http://ocsp.eca.hinet.net/OCSP/ocspG2sha2
-CERTIFICATE
 Subject: /ePKI Root Certification Authority - G2/C=TW/O=Chunghwa Telecom Co.,
     Ltd.
 Issuer: /C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification

int-bundle.crt

@@ -6271,89 +6271,6 @@ fEoIXppf8vB10x3mNeBW4L+KFVPATupuTQarDILbbpVObH8RtXk6nis3+G1yDn5i
 nNKFefD+IxxpmvL+aPWgT+IpfdSnWTsviER93t9Z+XTtKie9vSs=
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIHNTCCBR2gAwIBAgIQBVQjPBnG8p6lFfhbaJfb7DANBgkqhkiG9w0BAQsFADBj
-MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0
-ZC4xLzAtBgNVBAMMJmVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt
-IEcyMB4XDTE1MTExNzA4MzE0MVoXDTM0MTIyMDAyMzEyN1owXjELMAkGA1UEBhMC
-VFcxIzAhBgNVBAoMGkNodW5naHdhIFRlbGVjb20gQ28uLCBMdGQuMSowKAYDVQQL
-DCFlUEtJIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3
-DQEBAQUAA4ICDwAwggIKAoICAQDhJQ/ujduIM3Vnza0ffTpObZ3TLxTzY3TLASFq
-N+qEUAdLJlsJQ2whnmrI1QP1YGmPzPAi5B/n92oiMbcsFfLg/gBqQ/+HZca1GsGn
-TG0icCGKMfKXdIkJEiYcnsrZEqKVPNrpZ78IoGTj1kK3Re+X9Pb117VKFQJYfZhY
-S2C8zdcNmhMzU9Fh+XrV13izmjP3AIbOHU2UOK+o7HhRcIpcEINRIfcRPTSGXuVI
-zZeBgjVMGexl9mvFBaHuRxPWsyEnlBAK2SQ7ur5EE0YwP5c82NfXau47OOMr1JcO
-uRvnB0l/Nyr5d3jPVO1bRp2jgA6RQ8HWW18Uup+mjSRHQFm/cjiyNmw3/5nRXQ5Z
-Cqtp98CyBEV6VACuvlP2tefh+DyjMdKp/iFSZMWmZ/B1BwaUFIFVxifkAY8XwWpx
-175L+5RYfX4RM7FC92JsGNbPCWg+f2z2Ho9iraVj2wmnHyJCQR5vmYo+1/k/QHp5
-sKUBktKdPQgVpRABLbMydqiVDbN6mvsHEHgRb+GPx7oPJRp0KuUcmEGZ3yGH6JUG
-agqzakd2ZfY6z49iFxl7CijNGtKDHiHHLL++/2Fot2cbu3hNjc5n5eTBjrcjZuKd
-kHU0mKk2K4qalLmd7MyKsfgliVxati+MH215JKdSaMOENeJmjWMOJU3VGbLmeTen
-Ip1UMQIDAQABo4IB6DCCAeQwHwYDVR0jBBgwFoAUclu6qnI47iWQJLWUIvoJiMqL
-CvswHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMA4GA1UdDwEB/wQEAwIB
-BjA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vZWNhLmhpbmV0Lm5ldC9yZXBvc2l0
-b3J5L0NSTDIvQ0EuY3JsMIGLBggrBgEFBQcBAQR/MH0wRAYIKwYBBQUHMAKGOGh0
-dHA6Ly9lY2EuaGluZXQubmV0L3JlcG9zaXRvcnkvQ2VydHMvSXNzdWVkVG9UaGlz
-Q0EucDdiMDUGCCsGAQUFBzABhilodHRwOi8vb2NzcC5lY2EuaGluZXQubmV0L09D
-U1Avb2NzcEcyc2hhMjAPBgNVHRMBAf8EBTADAQH/MIG0BgNVHSAEgawwgakwDQYL
-KwYBBAGBtyNkAAEwDQYLKwYBBAGBtyNkAAIwDQYLKwYBBAGBtyNkAAMwDQYLKwYB
-BAGBtyNkAAQwDQYLKwYBBAGBtyNkAAAwCQYHYIZ2AWQAATAJBgdghnYBZAACMAkG
-B2CGdgFkAAMwCQYHYIZ2AWQABDAJBgdghnYBZAAAMAgGBmeBDAECATAIBgZngQwB
-AgIwCAYGZ4EMAQIDMAcGBWeBDAEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFQwADfZ99
-HtG9yxM4ll7ky9eZOoLuH+IpuC/F1trdc5oWCR087nOHPkDNRlbQbkZljYTg7qG3
-5LgtugFBXc0LPuwAPlKDngdRJguL9vfMDSnisW7JXFsv3ArG5zeyVn+vqK1+cqPa
-Pd/LdfpL0YFTWHEXyPnOUm7x97Dy9wU9dtE/h1G6L2AQmIkYK+fpIeXEN7uz4vio
-pcPvxEykO8QkAR74vLrLj87lKJABY6BvRbzkR+mFTvC1u1DOKeyUdSWYnOgVgcpV
-RXE5IyleB35EcyYSBLw6PAyV9+E4G6Gl3p8AQtD1QpIvMuKKLWqNHIF7fISv3VSj
-829LyyqRvPTwBywgYXMYOM2OmiGZYbooBDDsxOefyEPVKfw4vk84JQOoyKV/LtSJ
-4KAv1WFWefdoAfSzfK9EgH7q0f4+H0xx1lv4y47gyXyxVBIt0FdXrgsUs0MdCLTe
-CfB7BIWbofJ6241+ugEa0/JtJM1tUjIL0BeTAws+WFBIr46SeXPitJgQUfvVp7zA
-5Pgjmb8robprTMIAv1Hmlz4krE77hydE/APsZGH68gq/n//2CxHrj9qhADleYjNA
-oZEmf1C9NsaEya7pUzBUwcf/BQidnnAxz+pODwNBUIKC+cwPF+8uFx82AMujEfWz
-6WQ3FGbvbR5swAxI2gqIrtbfAmVRxMFvCw==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIHdTCCBV2gAwIBAgIRAMrh9z78rFuxnIjBxy9vey8wDQYJKoZIhvcNAQELBQAw
-YzELMAkGA1UEBhMCVFcxIzAhBgNVBAoMGkNodW5naHdhIFRlbGVjb20gQ28uLCBM
-dGQuMS8wLQYDVQQDDCZlUEtJIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
-LSBHMjAeFw0xNTExMTcwODMxNDFaFw0zNDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYT
-AlRXMSMwIQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEqMCgGA1UE
-CwwhZVBLSSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG
-9w0BAQEFAAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEh
-ajfqhFAHSyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrB
-p0xtInAhijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2Y
-WEtgvM3XDZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7l
-SM2XgYI1TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SX
-Drkb5wdJfzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0O
-WQqraffAsgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fq
-cde+S/uUWH1+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6
-ebClAZLSnT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iV
-BmoKs2pHdmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+XkwY63I2bi
-nZB1NJipNiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3
-pyKdVDECAwEAAaOCAicwggIjMB8GA1UdIwQYMBaAFHJbuqpyOO4lkCS1lCL6CYjK
-iwr7MB0GA1UdDgQWBBQeDPe2Z/LhkiYJRcBVOS53P0JKojAOBgNVHQ8BAf8EBAMC
-AQYwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2VjYS5oaW5ldC5uZXQvcmVwb3Np
-dG9yeS9DUkwyL0NBLmNybDCBiwYIKwYBBQUHAQEEfzB9MEQGCCsGAQUFBzAChjho
-dHRwOi8vZWNhLmhpbmV0Lm5ldC9yZXBvc2l0b3J5L0NlcnRzL0lzc3VlZFRvVGhp
-c0NBLnA3YjA1BggrBgEFBQcwAYYpaHR0cDovL29jc3AuZWNhLmhpbmV0Lm5ldC9P
-Q1NQL29jc3BHMnNoYTIwDwYDVR0TAQH/BAUwAwEB/zCB8wYDVR0gBIHrMIHoMA0G
-CysGAQQBgbcjZAABMA0GCysGAQQBgbcjZAACMA0GCysGAQQBgbcjZAADMA0GCysG
-AQQBgbcjZAAEMA0GCysGAQQBgbcjZAAJMA0GCysGAQQBgbcjZAAAMAkGB2CGdgFk
-AAEwCQYHYIZ2AWQAAjAJBgdghnYBZAADMAkGB2CGdgFkAAQwCQYHYIZ2AWQAADAI
-BgZngQwBAgEwCAYGZ4EMAQICMAgGBmeBDAECAzA3BgVngQwBATAuMCwGCCsGAQUF
-BwIBFiBodHRwczovL2VjYS5oaW5ldC5uZXQvcmVwb3NpdG9yeTANBgkqhkiG9w0B
-AQsFAAOCAgEAbvb5/9P544BlP4nZKjoQ/tzh5CZ/WUg+JAQgMblhtRa1Zmhpl2HD
-R1rzt/jRjxOhZMqtO1ogNI6KvESAt0pBBMZv9CTBvZv47p4HnuLxCxgFBk1s73vo
-uFc13OfAeV3EVAdzSrCZLfJHHfnuvPExW4SlmEzKp3seetbjH4DUSO6ZlwKUCTme
-p4DzbP82kDnwC7igowL0w+PKZYGiNvyjZr6/V1HLOn6Z6eBqVUeIgoJRxe49PbLc
-FFKXQdoMzAeElONPUpkv7/AX7CxflnbMWNwOCFrcT6pF3kLErgz8cA0PkW6gObjU
-zYs9Uk4dGI8AU4DSvamYe6abqPEBDjFec2EbycftofsqfGNF9T8HAZDAT7HnvKnT
-lRnQU66+IJo4Hw9LNjP/NwH+ZZJaRmyE870f+Lp+I6r/aS3yDARIqK6ZVrXh9VU4
-wWNoLRWpvuUIFbVpXl8cNTHgp7QEq6oUTgCDwy9LrinBiV44PGtEHC/2U1zrbuwk
-uIRo3Dgf+lMYOLbTAYiWm807/P0kJ/fzBO+/0cReN1n1blmMrl1WFJaPRehqL1YU
-2BAcJ3TM+E5yQJzQqHPXywTHPnRJO7Nn4iJmR3bSeW1w5GhVdeP69+IO0CM0Au1c
-U9jG7d32NlY1QTMUJo22nmCCAEJKAEomOyJJ+l7BFmnnYG/UQUWuKGs=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
 MIIHZDCCBUygAwIBAgIRAK/NjWQsYtZFBn3IV/2o8V0wDQYJKoZIhvcNAQELBQAw
 XjELMAkGA1UEBhMCVFcxIzAhBgNVBAoMGkNodW5naHdhIFRlbGVjb20gQ28uLCBM
 dGQuMSowKAYDVQQLDCFlUEtJIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw