[aberglund-cf]

Summary

• Explicitly trust 17 selected AAA-issued server-authentication CA certificates as non-self-signed anchors in ca-bundle.crt.
• Preserve selected certificate paths without restoring trust in AAA Certificate Services or emSign ECC Root CA - G3.
• Add unpublished database snapshot 2026.10.2, preserving all existing snapshots, including published 2026.10.1.
• Regenerate root bundle artifacts and add exact-certificate regression coverage.
• Leave the intermediate bundle unchanged.

Trust policy and consumer behavior

These certificates are explicitly trusted anchors, not merely additional chain-building intermediates. Consumers must support terminating verification at non-self-signed anchors; OpenSSL requires -partial_chain. Loading the certificates only as untrusted intermediates is insufficient.

The 17 certificates represent 16 distinct keys: two COMODO certificates share a key but retain distinct certificate identities. Nine certificates already exist in the database as intermediates; eight certificate records are new. None of the selected keys matches the eight compromised keys in the impacted-intermediate certificate list checked during validation.

Validation

• go test ./... -count=1
• go vet ./...
• git diff --check
• Reproduced regression failure for all 17 missing anchors before import; confirmed direct anchor termination without AAA afterward.
• Derived certificate fingerprints and database identities mechanically from the supplied PEMs; verified issuer signatures, CA constraints, key usage, and server-authentication EKU.
• Verified exactly 17 root additions, with every existing root retaining its DER bytes and relative ordering. Result: 355 anchors; 1,234 intermediate certificates, unchanged byte-for-byte.
• Verified existing database rows, schema, distrust records, and historical memberships remain unchanged. Only the two new snapshot records, their memberships, and eight new certificate records are added.
• Verified SQLite integrity, exact regeneration of published 2026.10.1 and proposed 2026.10.2 bundles, and unchanged membership inheritance on a subsequent release roll using a disposable database.
• Compared ordered DER bytes for all 216 historical root and 216 historical intermediate snapshots. Regeneration matched for all 216 root and 186 intermediate snapshots. The remaining 30 intermediate snapshots from 2017–2019 produce the same pre-existing x509: invalid certificate policies error before and after this change; historical parsing behavior is not modified.

[mitch292]

LGTM