diff --git a/README.md b/README.md index 046ec2f0..63ec52be 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,8 @@ Files: ├── README.md ``` -The `ca-bundle.crt` file contains the trusted roots. CFSSL uses the +The `ca-bundle.crt` file contains trust anchors, including selected +non-self-signed CA certificates. CFSSL uses the `ca-bundle.crt.metadata` when building bundles to assist in building bundles that need to verified in the maximum number of trust stores on different systems. The `int-bundle.crt` file contains a number of @@ -69,8 +70,14 @@ built as follows: $ ./release.sh ``` -This command automatically removes expiring certificates, and pushes the -changes to a new release branch. +Run this command from an up-to-date checkout containing the changes to +publish, with no unrelated tracked or staged changes. It rolls new root and +intermediate database snapshots, filters revoked and expiring certificates, +and regenerates the bundles. It then commits the changes on a new +`release/` branch and immediately pushes both the branch and a +`trust-store-` tag to `origin`. Branch and tag push permission is +required. Open a pull request for the release branch afterward; the script +does not create one. The content of 'ca-bundle.crt.metadata' is crucial to building ubiquitous bundle. Feel free to tune its content. Make sure the paths to @@ -111,15 +118,21 @@ These calls to the `expiring` command will provide an output showing if there ar ### eMudhra compromise mitigation (October 2026) Following the [eMudhra intermediate key compromise](https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/), -AAA Certificate Services and emSign ECC Root CA - G3 have been removed from -the root bundle in release `2026.10.0`. Dated distrust records prevent future -release rolls from including them. Historical releases and platform snapshots +AAA Certificate Services and emSign ECC Root CA - G3 were removed from +database snapshot `2026.10.0`, first published in tagged release +`trust-store-2026.10.1`. Dated distrust records prevent future release rolls +from including them. Historical releases and platform snapshots are preserved for reproducibility. emSign Root TLS CA - G3 and the eight compromised intermediate keys were absent from the bundles. The unaffected emSign C1, C3, and G1 roots remain trusted. Removing these roots can also reject legitimate certificate chains. -Replacement intermediates are not included. +Database snapshot `2026.10.2` explicitly trusts 17 selected AAA-issued +server-authentication CA certificates as non-self-signed anchors in +`ca-bundle.crt`, preserving selected paths without restoring trust in the +AAA root. Consumers must support terminating verification at these anchors +(for example, OpenSSL requires `-partial_chain`); loading them only as +untrusted intermediates is insufficient. Consumers must deploy the updated bundle and restart services that load roots at startup. Rebuild Go services with Go 1.27.3 or Go 1.26.10 (or a later diff --git a/ca-bundle.crt b/ca-bundle.crt index 82d818ff..62d65b04 100644 --- a/ca-bundle.crt +++ b/ca-bundle.crt @@ -6492,6 +6492,34 @@ iRwUY+i5g6m1u+hjmnoZjMt09/gXCPGLGdi07B5uSXM/XCDdNSqWd+lGbxY7y6nv mwohEcjDpMkjRW0/YpWd0yjHnQ+z/jeNHUiyUOYluU4zYTbWFhzKMjcgdhws -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIEvzCCA6egAwIBAgIRAIsSfqglOEYp3iuvzlR1NogwDQYJKoZIhvcNAQEMBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0xNDA5MTYwMDAwMDBaFw0y +OTA5MTUyMzU5NTlaMIGLMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBN +YW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0Eg +TGltaXRlZDExMC8GA1UEAxMoQ09NT0RPIFNIQS0yIFBybyBTZXJpZXMgU2VjdXJl +IFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKfDF7ks +P98PglnEw+2reeiYfnyLHnFh6nHteiwESpgltt6C6LZs3DO3Kjd0ZLutEhY1slAt +2+26sHAsy2kA+OIDxwW3n06ScYQHP3lCZuhjMuUT+id2gcJhtzlvag+MiPgUyIWJ +S6YRsnlOtRR0gIJj4yyBiexPVHUmgBgF5UjJWaL/2V99mrfvIZdTkcuF0e9sW8Fy +Chyz0LA5YLlWCAXM+0OOCBv6sbxSrcT8VO/tR3+LDssPoOZ2Id/YHF+T4CXUtZ7u +CC9/DQhXEx5nKHffKoCokzHxVR35+VeSEu2bfiGxhWR4gYd7dm3reN91ORIMStG5 +npyxE0NqMg6kKRkCAwEAAaOCASswggEnMB8GA1UdIwQYMBaAFKARCiM+lvEH7OKv +Ke+CpX/QMKS0MB0GA1UdDgQWBBSAtisNQAoP3z+kv78D9LF2a9XnjzAOBgNVHQ8B +Af8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADApBgNVHSUEIjAgBggrBgEFBQcD +AQYIKwYBBQUHAwIGCmCGSAGG+E0BAgMwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeB +DAECATBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9B +QUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYB +BQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQwFAAOC +AQEAHcZE6y+TuNJp8PSmAbbNJmNwuJxZUcQ5/wKmPQrBl/8n32AX6dDjwk7qm/WB +vvmE6M5oydr0ynLOt5eJ+JDJbMJ2gBKPS7MTLLmMrP50dsge3odg5+Xn9HZTSwna +RVjoaSaTzkDAV7plP1/hDkFb5j4PzbhphhnEN92rH5Lkkoge7wBNGjc/FCt7Ax5l +8A2OBCHziYGHLx708cSNj+4v0zXxeBKMqQISrkDM9Ev/diDPpktA/NP2fOcPT7CZ +WYNE/2OJw6PYMT7TRG362EAtMz9jxyauzoxEJ2ewOVYfSpJ6DNoAd6V1rvuQkQzs +OuP9Gcq4u/mR0nkyBoDiIxx51w== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIIGAzCCA+ugAwIBAgIQL9Z6QyKTMpBF6VM0PuJ0ZjANBgkqhkiG9w0BAQsFADCB kzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE9MDsGA1UEAxM0 @@ -6646,6 +6674,34 @@ RkDH30jAB64volYYepq5wxhQFh+j40zDnmAuYC/pDOFZoRszKSuREjx9hTaieBIR 4sBFY8WLdJMuwrRbEWjHccjm -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIEszCCA5ugAwIBAgIRALm8Dvlxug7myHs2fXKPFsMwDQYJKoZIhvcNAQEMBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0xNTAyMTIwMDAwMDBaFw0z +MDAyMTEyMzU5NTlaMIGLMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBN +YW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0Eg +TGltaXRlZDExMC8GA1UEAxMoQ09NT0RPIFNIQS0yIFBybyBTZXJpZXMgU2VjdXJl +IFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKfDF7ks +P98PglnEw+2reeiYfnyLHnFh6nHteiwESpgltt6C6LZs3DO3Kjd0ZLutEhY1slAt +2+26sHAsy2kA+OIDxwW3n06ScYQHP3lCZuhjMuUT+id2gcJhtzlvag+MiPgUyIWJ +S6YRsnlOtRR0gIJj4yyBiexPVHUmgBgF5UjJWaL/2V99mrfvIZdTkcuF0e9sW8Fy +Chyz0LA5YLlWCAXM+0OOCBv6sbxSrcT8VO/tR3+LDssPoOZ2Id/YHF+T4CXUtZ7u +CC9/DQhXEx5nKHffKoCokzHxVR35+VeSEu2bfiGxhWR4gYd7dm3reN91ORIMStG5 +npyxE0NqMg6kKRkCAwEAAaOCAR8wggEbMB8GA1UdIwQYMBaAFKARCiM+lvEH7OKv +Ke+CpX/QMKS0MB0GA1UdDgQWBBSAtisNQAoP3z+kv78D9LF2a9XnjzAOBgNVHQ8B +Af8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcD +AQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgGBmeBDAECATBDBgNVHR8E +PDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0 +ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6 +Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQwFAAOCAQEAcaRIjF1YZ7iv +BA30KvRTacpH8N5bdoHYzvaF6j4vutHLvuOg8BQXB7d5+USfSp4Qr6E5SUfCvy4g +nKWsKsXQH3vK/lE6nL/a8Ygh9/vT8wZxKkA/FfEIVojYQ+pSUANDcepe6BtmF0WL +7Pr/03swQDBUI8VzXMuDlUVSFbPUesUOkR4h1Rmh9RVfG+mCS20queLLMcTCFJg7 +cz3HrViPJ/vp/YYsctfXRHoEngqg8FqvFpmaz6zEDh0Wd1odBGwAfcI/oGwSmn6z +sPZ5mBfOcsxxtwyH6sLpQQidsQc1VtwUp/c6vOf8m30O32OHrKOwltKNq+CM8x+k +c2suZlR4ow== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIIFWjCCA0KgAwIBAgIQT9Irj/VkyDOeTzRYZiNwYDANBgkqhkiG9w0BAQsFADBH MQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxJTAjBgNVBAMMHFVDQSBF eHRlbmRlZCBWYWxpZGF0aW9uIFJvb3QwHhcNMTUwMzEzMDAwMDAwWhcNMzgxMjMx @@ -8502,6 +8558,33 @@ UG7BJw+ch69u1RsIGL2SKcHvlJF40jocVYli5RsJHrpka/F2tNQCMQC0QoSZ/6vn nvuRlydd3LBbMHHOXjgaatkl5+r3YZJW+OraNsKHZZYuciUvf9/DE8k= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIEnTCCA4WgAwIBAgIQWTF/amkEEUMds1dG+OqyMTANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE4MDYxNDAwMDAwMFoXDTI4 +MDYxMzIzNTk1OVowcDELMAkGA1UEBhMCSlAxDjAMBgNVBAgTBVRva3lvMRMwEQYD +VQQHEwpDaGl5b2RhLWt1MRswGQYDVQQKExJDb21vZG8gSmFwYW4sIEluYy4xHzAd +BgNVBAMTFkNvbW9kbyBKYXBhbiBSU0EgRFYgQ0EwggEiMA0GCSqGSIb3DQEBAQUA +A4IBDwAwggEKAoIBAQCFZZ3ZKbX5tLhPBbotlpsf67GaL2Zavrm6d4iixF4HOjdW +fGIef9usFDnQ/9LZfwFUvBR3Zftp9LODgEu2Y6AUasIy71P4sNpQtJopPc6WxvWN +F17OC4fNDpexFS7cNJkmPCTSUaLsy8vUPm0Fliza+rbgT8VEFkq25QOIXbX7Sf2C +Dr12g4Ov9PLqF/FvmBlD+Z8dtjcWSDafERsgSHaVLOH5DD13GOsPzzu6w73+Hfdg +GvT+LgpJsAdt5l9diMS9nNfaYZN8UGoi8Sq07zDNpKM7EV+MqRomSwXbLTrcOIGx +LCfjibr7gnGQj0GyaiNR2hawVHVUkqqgGXvJoSwJAgMBAAGjggEmMIIBIjAfBgNV +HSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUIZEBzIgfs+Yu +Q/R88TCJi0FsHUowDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAw +HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYB +BAGyMQECAj0wCAYGZ4EMAQIBMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwu +Y29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUF +BwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0G +CSqGSIb3DQEBCwUAA4IBAQAEolN/OqKPWfzwfTRTdC1OIps5VQoJnVQD6hCOkcfR +1nQGmQpe96CnQNxbfu5SszjGBaImtJOEt5L61kG24jJwQNvQyYAGWxAYHD6+CozB +SXMn2q68j6fQxlD64om74TXnD3Z4skX7zuPbYchevQ/BHKFFAkh6vJJ91ppz/WfF +SldW3aVWpLcB3CZqZCpmRiIpqK3dDW7Rue4kt/y/woJ1eiWkC17+bCepN9WiOj8P +GFc1t8tyrAZzq8+2IXeIpZJMIGP8+6SWZdUBxRFyIuOxMyWhSlx+OFYDjOo+wQsd +eF9tlPKYiqJ7/G4HVhad0mWlh10pn0IZjlWwhh6ESs2s +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIIFajCCA1KgAwIBAgIQEoG5GPN5OkKTzpFYYeTtXDANBgkqhkiG9w0BAQsFADBP MSUwIwYDVQQDDBxEaWdpZGVudGl0eSBTZXJ2aWNlcyBSb290IENBMRkwFwYDVQQK DBBEaWdpZGVudGl0eSBCLlYuMQswCQYDVQQGEwJOTDAeFw0xODA3MTAxMDA1NDJa @@ -8574,6 +8657,34 @@ DLQkgzbYhCLdvDolc33xA0+Ge1bjzpH6PbpGDZxmWKTFM2ZJQQYNvWH7P55T3pbE 53TUes0DYl+ICmA+jPmN4YzcGrI= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIEuzCCA6OgAwIBAgIQFMfOWTeODs3ocezWp4xhNTANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE4MTEwNjAwMDAwMFoXDTMw +MTIzMTIzNTk1OVowgYgxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1h +bmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGlt +aXRlZDEwMC4GA1UEAxMnU2VjdGlnbyBSU0EgUHJvIFNlcmllcyBTZWN1cmUgU2Vy +dmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwx4YXoLwl2b4 +QhWnXxnYvFcjCGAewDI2iT39FXYvSaiK+1A05EBmxXGRttOnl8OLjB29ImQjWhMn +P86Mh8sV/CfxBUnnpDJC40h4eqHEpX9otWLjLTNsKUXD4V94d52Wyjv53Dwv3U/W +eNt4xgNbgPJkASioGUaO5t6sAUwWMYWA4an9AKupg3byc5SEOWH/B4qm4AAo5xGc +zo4fJECPYvgIt9EKDWUp3tXKCKsxqxC2h4raKokTtrAnKCaCwaqyZJzLu9ZXLOjy +HcQoXwrMMyOO9W5DH2aos6NJEjw5DMhy/I0TttHqFlKwXVdl5L4wMVZSpp/u0yCK +QP+GS4LV0wIDAQABo4IBKzCCAScwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Kl +f9AwpLQwHQYDVR0OBBYEFIHFuh2zAn3Bv1bxaAzoB4aceoDGMA4GA1UdDwEB/wQE +AwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMCkGA1UdJQQiMCAGCCsGAQUFBwMBBggr +BgEFBQcDAgYKYIZIAYb4TQECAzAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQIB +MEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNl +cnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcw +AYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAj +8Y6ulwmqXyi3huINyFS5P16QGyauAJpQ0QRS7LE0rF6gk+qdKruOUUnztdAepg3S +TxzyCZP4ewki4asVk4ZxXW/XQ4mQbvc5bGk60yAp8Dumx+l4X4awcUl0pN/L37mt +QGpe5MAC0AmW3i+H+UXQtdtypfCOfgyC0a8j6b1NWFgsTQK1l/yEZcuAT2BDJcl2 +ehye7+u3UqfM15JueAcUByFBASokKYYbDVOuP10HDEfJB0OXx8ZQjMybB+wtPMTf +hYUHNLNxezftAZk/INrtwLrU7OXAOR5tM5MHMroducCK+2VFK4mB+TTzFokdHQnf +jv8WxygOnqiipIqhVvwB +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIIFdDCCA1ygAwIBAgIPAWdfJ9b+euPkrL4JWwWeMA0GCSqGSIb3DQEBCwUAMEQx CzAJBgNVBAYTAkZJMRowGAYDVQQKDBFUZWxpYSBGaW5sYW5kIE95ajEZMBcGA1UE AwwQVGVsaWEgUm9vdCBDQSB2MjAeFw0xODExMjkxMTU1NTRaFw00MzExMjkxMTU1 @@ -8730,6 +8841,56 @@ u/2QeItBcy6vVR/cO5JyboTT0GFMDcx2V+IthSIVNg3rAZ3r2OvEhJn7wAzMMujj d9qDRIueVSjAi1jTkD5OGwDxFa2DK5o= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIDxTCCAq2gAwIBAgIQcmYYdTrWySLFbJ3h84R4sDANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDYxOTAwMDAwMFoXDTI4 +MTIwNjIzNTk1OVowZDErMCkGA1UEAxMiQXBwbGUgUHVibGljIFNlcnZlciBFQ0Mg +Q0EgMTIgLSBHMTETMBEGA1UEChMKQXBwbGUgSW5jLjETMBEGA1UECBMKQ2FsaWZv +cm5pYTELMAkGA1UEBhMCVVMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASXeXEn +8c9E2Yz/wRm1h1nu0bXLeJE5jE1KoRg9EMpqvAp/dJXkt55PMshirJY11V2e8n6F +Eob4GkhYnzFGbrAwo4IBJTCCASEwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Kl +f9AwpLQwHQYDVR0OBBYEFF/jLoqUl97TXOG31LyYjjEpyZA6MA4GA1UdDwEB/wQE +AwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwIQYDVR0gBBowGDAM +BgoqhkiG92NkBQsEMAgGBmeBDAECAjASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1Ud +HwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmlj +YXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0 +cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQCj3G3o0UlY +2Mhej3oddvVnuieM19jahBV0OBTA4WPEqWyycEubm8+s9zWzALPqYdnQU3/DWCS0 +PUlxsE16N7VV4C9kYkdDIfyZzWzPoEuuCN4s5oDUQ0UmXzJPvfuJX87HZxLiBtzk +HQHowsXqhkFmfSIadhOW61Q/xDia/LWNPIkncB7Xs8+TTCMhf8oorfM4P9hqSLzb +Pq4nJ+1kWaNEPCIPC3zczBl9joB8WDXB6fuWyadAJI0lVqB/jADhQYu/qJGo5tsQ ++6qvg7X6ZGXQp4O6g+mLcQ2BKReqzZtQUIGpXCFYNHdi8A89c8QqPKeazcrBrqH9 +z6X8AMunwFlY +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEkDCCA3igAwIBAgIQCuSPIwEwZEGSWeHCmumNGDANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDYxOTAwMDAwMFoXDTI4 +MTIwNjIzNTk1OVowZDErMCkGA1UEAxMiQXBwbGUgUHVibGljIFNlcnZlciBSU0Eg +Q0EgMTIgLSBHMTETMBEGA1UEChMKQXBwbGUgSW5jLjETMBEGA1UECBMKQ2FsaWZv +cm5pYTELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB +AQC9vhI3XrifeRWYC+x6U5sPCaYAPncBLBBsyQdt7ztiyROEG6fEKZG1tToZMES3 +jtgqV+7RcBV9xX2jVeU+EwAnHkIpwoDWcte0gLfALL3hkVcwXJoJaojVF8mMHlJt +QYTr3FYkZ6FqALt/LFUxeis3/Zgtug7EoqBsZeF5g79lSZtZqcNLm+3NuvZUdAHB +GIzD++wVlOhy9IxahD/Z7eIkpuJTedYVpLmnX/fHq92gYoNHezlNN8vdILlsPV4k +IdrwTKso7II25Kha0/l3hx2xEBtUIQLMGxKF+fD9AjcYhSMqhTM5/2tyud4QJxIy +409Dj4OhNooHAxurBDHwV8ZlAgMBAAGjggElMIIBITAfBgNVHSMEGDAWgBSgEQoj +PpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUHlwXkQVXAvx3XONwQ+xr/d3S2Gkw +DgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAh +BgNVHSAEGjAYMAwGCiqGSIb3Y2QFCwQwCAYGZ4EMAQICMBIGA1UdEwEB/wQIMAYB +Af8CAQAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v +QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsG +AQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQELBQAD +ggEBAGa7XPTd+1lgnT/dDf2agLAIIXpbTn6XtEGMq9jovXbK076zHlQSWapd6Zd/ +p/uWydwuTbd+cobkUTFZhKGMkY0e8gXgI2s09kQ0EfotFUOdQ7qf1U+UM7JIEZmD +gsTn9vBLNwbtwH9t6cvYxH//VhWyL07pPkfTFBVqvAprGZ9MgraZD2S9qYu9usfS +vuH4lr4b3NuZ7mh3zOs4aD3Omgx30DU8DV82LikGN4/MF+uDOGgHtPv0ozlvPrFc +8bsE+lTnjP199w5X+kPtpzrkjYPNrGxTg4nhugo6y+GPOCl00S+T/794oTq/HFlj +6IoOvOR7UaKo39qnYwA6Fs0F0to= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIIGrDCCBJSgAwIBAgIJANLVi0S/gZNCMA0GCSqGSIb3DQEBDQUAMIGYMQswCQYD VQQGEwJCUjETMBEGA1UECgwKSUNQLUJyYXNpbDE9MDsGA1UECww0SW5zdGl0dXRv IE5hY2lvbmFsIGRlIFRlY25vbG9naWEgZGEgSW5mb3JtYWNhbyAtIElUSTE1MDMG @@ -9112,6 +9273,137 @@ bDpwJANg8eeOMAoGCCqGSM49BAMDA2kAMGYCMQCP9ck/sU7z99GdtLoPPQqXJxCT oF3pk9ZhxOGhuVyo9fFnXqIpN8JLxmdy/oyQ+SSAd7c= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIEfDCCA2SgAwIBAgIRAMgg4L6eNeCxmyCeeRyzYhswDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMDA0MDEwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExp +bWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gU0hBLTI1NiBEViBTZWN1cmUgU2VydmVy +IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqkLSwI1+KQBSTZjn +rGq4hFW3nrB403nU1+Ywh3d7LJlRs+zGdWiL/qI5dLnreHxNI6IDrN++ANqtHDk9 +2k8ETW2UASZAblUXHe1Rpf4LppPKXmfrO1lovP/yR1KyuGjo3G/pWTGzEinzRoBB +X0EsOgoo9umn7fhbh+71/SiPcFX2v//qsVgvT83TV/6CTj7cDXum0U1WZR0G3oF5 +RHZmrVHC7lVfS0jYNM9azcQ7TzX4HMk8ssw+zW7IhIwTlcx6bnB6x3H+8GftAGql +byS7wM24IomEeLswQgsobA9WRYQcbvINJiz+XeVdHw+5xWJWkVIpjkokQjY2oWm4 +HBG8fwIDAQABo4IBHzCCARswHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9Aw +pLQwHQYDVR0OBBYEFGZSuGUuqrTyQXsKdP+YwgNo586AMA4GA1UdDwEB/wQEAwIB +hjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF +BQcDAjAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQIBMEMGA1UdHwQ8MDowOKA2 +oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2Vydmlj +ZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Au +Y29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBqUWCzcno0B+RcHhp+RJ85 +/rET65L8RtDmYjTeJwfrs6g1BW3D2iUadhabWS8npNhcZQDubjbr6FNVplp4WOgR +iN5jGss1Nh3Q0I1LYr5Z6ZgvFeNE/OqZXpe96xCdBGl4wcNWFEdzAizQDs0BSZmk ++1XWycJ4lE3p5hJVR7wfUG+Sy0OVHBH+E4C97sCcZ+hMZb7Yi6QjElFyx/aIfhH1 +1dCG5TajVtkhg/6q5v5k3/Re0v1mJm2q2C0qJDx8Z+3eZ1wK2pdLppqHwL+l5hRO +84A6Ezt8uB0vIXdUd5onnMYyc1GZV0eTzSOWcjNOezXCJeZ4ScSObJJc1GHfcWKb +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEmTCCA4GgAwIBAgIRAOevSvR8tqm/q00QCVq7xrkwDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMDA0MDEwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExp +bWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gU0hBLTI1NiBFViBTZWN1cmUgU2VydmVy +IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvBGkUq59/askCsp2 +SA7hF4NIwwAegIMr1WzPHrdC1kFEGb24eUnvI+AVsjc8KzoewphkH8r5tbVLkgmV +LVxMPEeXFqaZry9mh0doOxOKN9PPKIUqUr4LjQhlWrwhrSlGXXnwVvsivVV/yWAh +KlFuk1oYk1y6qXkP39HmX+bmo+QocMJelemCrEMXeM1945PY/s6oTy6tSP8LuK3w +bEvEFaFwjVGK7zRDbvgLwrCRgNS9NyeelC6+pnWMxsyT+VjWuziMXFuJhafs18vv +l71flWJDoyCXcrVsK5veEccIEwV5SG3cvuVAe94FcpgeHjEr1BM5m4TDmmQlmTfS +IEAWzQIDAQABo4IBPDCCATgwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9Aw +pLQwHQYDVR0OBBYEFAHblKhitGAIU5X21Kge+/YEo0aqMA4GA1UdDwEB/wQEAwIB +hjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF +BQcDAjA4BgNVHSAEMTAvMC0GBFUdIAAwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9z +ZWN0aWdvLmNvbS9DUFMwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21v +ZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEE +KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZI +hvcNAQELBQADggEBAKGQtIOP+c8LC3Sw6wWKQKXbgDB8BOpdO1sHugBSWlgB9NrC +Au07YHkVahqwdeCHgoZ0StjeFuQOvqOTQoVE9h5MdlmUiLvWUeSDa4y9/puC5hU1 +6Twy/UWOwQidmVL/MI6eV9BhcwFjLvNhjFQMDP3VvAyT9XGVJhNP/TV+ffCh3Ppi +hM2xyohIU7oTT/843EEmcOnx9aQF9Rvrpu0Z4dwYbCHpYEy8LFQCgy5U6VVcxshi +VBZYF3Sx7e+8ZX6JHBHP4QATiEqNoo6YbJkShr1tXv+ckRBTN+gL8DqncUtDRpsK +Q5UXGuMaRl5UmH9M16MyhD7QBEDxdlzkd40wuBY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEfDCCA2SgAwIBAgIRAONaE0BUjAMEn7ijP6lKhlkwDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMDA0MDEwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFUxCzAJBgNVBAYTAkdCMRgwFgYDVQQKEw9TZWN0aWdvIExp +bWl0ZWQxLDAqBgNVBAMTI1NlY3RpZ28gU0hBLTI1NiBPViBTZWN1cmUgU2VydmVy +IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAi9dODoyvqLHqOEKa +wSaFcZSx5GgQevkRrBqO4pG7ltn9o2EGVPYBpptGyyL7RgG9YHsn0Tx4mII5/zYe +zr4+53e7r6OER4SGnbewxrv6JOqPHgAc9IMsq33U4WXc94i84Gji1cgCOLURvs8M +YeARz9Aii5vbzZ8NOoWI3B/ChCWXhfRbMEbVKZyYHGUMrdrA+Z98TX68oGrTnMud +ClRFed0clGXMVIciR6x9q9diGGE3R9DjAMQtNVHLbFVXipE15UQZ9oXc05UCuZVH +/V7lMHPIggJDfytAGfdiT0j6ECcckgjh3NixqKK0fHvh9B+mmxq65RF5i6bWR+2a +i4bB9wIDAQABo4IBHzCCARswHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9Aw +pLQwHQYDVR0OBBYEFGIVH4kWOBheNOv63IYHEIrU7VZqMA4GA1UdDwEB/wQEAwIB +hjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF +BQcDAjAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQICMEMGA1UdHwQ8MDowOKA2 +oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2Vydmlj +ZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Au +Y29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBAtvap35qabbNChxinBt6s +g5LK9P+jkQ3YR0HMQMHhVzF3tSy20wNPEjID9A+QkihaH5yPychlVHHna0zC9/rq +ad4NSMIZwgt54S4zLUETFVZd19qME7jjXgXm/BYgxbJwD9f5G20cl0wKNYxSuid7 +TUZLOY/jGhI4mJz8y9ZKgIbrdeNu/okqENE5Gbvi7GjeQr2ntVWOrwpOYD29s+nT +PuVM+2ztJlmerETMQlOChGtDv3ruE/fbDFpQQxR3zpbg+9Dk+RllyF3e87X7Wt2X +qSfL95/8DfmzvZuiSsWScoa4Hdm/fc1GOxmV5CiNuRlsXhynP3rimEGdlAKJJQvE +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIQT7cxHGT9kPGYHf/B5LCYvTANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIwMDUyNzAwMDAwMFoXDTI4 +MTIzMTIzNTk1OVowNTELMAkGA1UEBhMCS1IxDTALBgNVBAoTBEtJQ0ExFzAVBgNV +BAMTDktJQ0EgUlNBIERWIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +AQEA1fQXd166CHH5+6RLOKOGCN9WKQeYoPWc7ogxpGpQh+rfyOQvvsW4sz1VpLA3 +UdWWffG3G+/MOhgX4WOPTkWGHm+owoD/YOPPeK+gHN93QLtBroqiwBxMf1WbCyKM +BCNtgHsHTRNhfWsUdhOWk8xPztekazIAVVAnEZza2TENiDGWUIvOVSyDogtSCgDg +4KxFBmCNtaj/Y+PLaXH6A6wdKpQ+G9VMaLDlHP92dxLBZnjIzH3dPMCzQlWcw3hb +SXeH0vHUgjkdU5t8pRZnGqziV1CV6p2tMlSpV9D4GRQNi16/HwbYyoIx2lskw5an +z5U4PTVrCnqa1EwWdYywvRhr8wIDAQABo4IBHzCCARswHwYDVR0jBBgwFoAUoBEK +Iz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYEFACyhYjxpuX174IlBE75Zc5GwREL +MA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQG +CCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQIB +MEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNl +cnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcw +AYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQAc +PXWNpDa5gyl9Rv+dc77EzmD9pQZE6JByb4f53riITW07+D9JXDRilTlRU2H2dFrW +nIBzaJwY7R/1m70kBkfd0uPgOiw6DV/5U4HS/IiAKnqXgH4UzAbA1oMAxrXtp2BM +8PpwafDjoI+8TYjXK2f5qVXWmPIpUBIHEKkx1jUCeIm7ol5c/3LNVLobpfJ4hwvS +ixfdO0AZMHghA7qsh8ukzHdqz07bU+/Y3YF9RTP0u/JdrQuu4s1Mo88gpe5F0d04 +e2l1eehJwxfcl+26MaBwpPIlI+vIl/cdwQNdFVzfGQH80b12VocjgU/xClJ/kPtl +aiB+4GkaQn9In82v+AuH +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEWzCCA0OgAwIBAgIQQAm3l56tCrIb/S1vLGJmkTANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIwMDUyNzAwMDAwMFoXDTI4 +MTIzMTIzNTk1OVowNTELMAkGA1UEBhMCS1IxDTALBgNVBAoTBEtJQ0ExFzAVBgNV +BAMTDktJQ0EgUlNBIE9WIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC +AQEA1Rm7lc2N04hcIY+7xL9eVeAJyuwXX988Y0SHkGviT5Lgyv59ctK+tfuIygWC +E4LDTJWJxx04Zrzh01fNhiFVfi6Qw0NcMkew6rS7NU6BUWZFuXy69ByfjEi2bjp8 +AGpvErpX8YZZT9IEh8Rb3qyksaKA1ZLbRbGQ/UzjJKHNJlBYuRytSr4IfgUh9g5A +a4EmKsQxTkngF1rUKKUeKW4EiA0wfFLbgnWVqaDdMZIqK0Qiu/4w9kVfQx1gGvgP +XtPxm+92x4yqG8BoDonre6HvMEHYXU5p3FVYYwbgrg7qIZJaRvxwHU6lrCLL2EKL +rARCgIJKYHd7sxo9CLrqxQr5ZwIDAQABo4IBHzCCARswHwYDVR0jBBgwFoAUoBEK +Iz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYEFABZzaC70pLwvu5vUoupzjd0wSBI +MA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQG +CCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAwCAYGZ4EMAQIC +MEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNl +cnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcw +AYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQCb +wCmqK+MxNjFhMx/zmY+y/Jd3Bqt1bRyXJmiS+cwOzqeSQ96PvXSQHJOLwmmQgTiI +ldnX0l5UYz6MpKLRlsmNnFQdQkP75sPHfW31ThNSoaC8/2BqeHuAHGTs1Bke7v8a +BMAFBBvfypAq77x9MdHNGc0Whr/gBMB5U9SJyEsQHrMzaDK6nfUUfqCZyYVpPtDj +634xdrF1xFx8iqYMN6Scz48XgiBRMVut8mPvwmzhoaK5vwZKKnXftSK5X1r82HCU +wlbUt33hKbiU+Pdi8P53xM5qPMvuo686iGP8J+1PEKeaa2ECFozDnnyrSlVwFBH6 +P4rDDpwYU04Zr1UzEn9j +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00 @@ -9265,6 +9557,159 @@ LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- +MIIDvDCCAqSgAwIBAgIRANIa373DxFdyvfaYsrrY+w0wDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMjAxMTAwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFkxCzAJBgNVBAYTAkNOMSUwIwYDVQQKExxUcnVzdEFzaWEg +VGVjaG5vbG9naWVzLCBJbmMuMSMwIQYDVQQDExpUcnVzdEFzaWEgRUNDIERWIFRM +UyBDQSBHMjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKDFp+iCMBDp6nATCxTZ +2oW6Db+OtInYf5nNOqXCS8I3rL5h5cT1Hahjld2UourXxkm69wY+OASvM3LinY9c +XNmjggEmMIIBIjAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAdBgNV +HQ4EFgQUAaaw/ZbHSqhpIrIRnmDbajTGFFIwDgYDVR0PAQH/BAQDAgGGMBIGA1Ud +EwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIG +A1UdIAQbMBkwDQYLKwYBBAGyMQECAjEwCAYGZ4EMAQIBMEMGA1UdHwQ8MDowOKA2 +oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2Vydmlj +ZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Au +Y29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBjcEJJQWBO89uDmMx4l2Qg +M6ScTVzktop56B8Cp++EasnhtW3JZ5ptPgOrQYSOZkKwF7S1bhV69IKI8xm1/Z/N +xh4XcxRXUllsgMstJnvArSvtS98zIyQ63+sKBuSXUM8rthH26zlmMn8ENofliCqQ +HJla0ENuQp2E/e1BnYlRUIy4GUPn49TOtJ1LFZ4+sO6q3NKCN9BMSJsAKDuCSlTl +XSDU5gW6FTI204DQgjmtsnWVsiGLSM116divMhYj/FY2M27b+Vc9bS1ACcmMgRfb +7KE+GA0Si03OG4UsY/7iR0pqe6Jysy5vs00jAOcYVU3Cx375vN/ap4oN+0qxYeUW +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDszCCApugAwIBAgIQJ39i5Fft6zHYiuH7yLKT8DANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIyMDExMDAwMDAwMFoXDTI4 +MTIzMTIzNTk1OVowWTELMAkGA1UEBhMCQ04xJTAjBgNVBAoTHFRydXN0QXNpYSBU +ZWNobm9sb2dpZXMsIEluYy4xIzAhBgNVBAMTGlRydXN0QXNpYSBFQ0MgRVYgVExT +IENBIEcyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERfLbPKOCg7aWIBEVCWGF +rfSnJBiTueHcPcSTpaS2OP4i33UBlitV8P4nICnwjyc+hhX0gEfG2Ts79Zx9dM+X +L6OCAR4wggEaMB8GA1UdIwQYMBaAFKARCiM+lvEH7OKvKe+CpX/QMKS0MB0GA1Ud +DgQWBBQ3ZCOm49Y5+s2mwlyM8E9X8tzD8DAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0T +AQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGgYD +VR0gBBMwETAGBgRVHSAAMAcGBWeBDAEBMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6 +Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQG +CCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2Eu +Y29tMA0GCSqGSIb3DQEBCwUAA4IBAQCU7wT4ookqZPH1yvfxiCa+y5O+FTkkqsQ3 +qtIQ7kr4KZGkcMVaubWeRKTVBIxqeh4Um7FCri7MbHTAwRqLcesxxvCuKTGdeLUD +Xsnw26OkuFveApSj/EEufQrMjYOg1a/h6IuWVJrMlnqA1iFUPQnXQpVSxkNIggrb +nBAkBH7b3A4eGS1yo/tYNtdx9CSAuy1KEQqTA7Ysqff+p3xqCggen5ajhkj6adSq +vSxM/h5z32upApqpanKBMmeaR5bMTMOP7iDDvrp1+f32P2FfzNim6WzUngibfKre +7Fs7jI5hO4GceqFxeAj0ZIoUmlFA3td6Dg1CudHk3bEp5XyHBtLe +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDvDCCAqSgAwIBAgIRAIDWcpfPZ4zwMPbBFeJ5jkswDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMjAxMTAwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFkxCzAJBgNVBAYTAkNOMSUwIwYDVQQKExxUcnVzdEFzaWEg +VGVjaG5vbG9naWVzLCBJbmMuMSMwIQYDVQQDExpUcnVzdEFzaWEgRUNDIE9WIFRM +UyBDQSBHMjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABIcQaRmbfWmVdNfqkSaB +SYo5rvQiHyRR/p/cx08OPB5Ja4/hbQfaxGY9tRRnjEgtbAUm05VuzJhmxbyQJGzb +cdSjggEmMIIBIjAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAdBgNV +HQ4EFgQUh/g2HqIMzF90lFjfFu0J+jjZxBcwDgYDVR0PAQH/BAQDAgGGMBIGA1Ud +EwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIG +A1UdIAQbMBkwDQYLKwYBBAGyMQECAjEwCAYGZ4EMAQICMEMGA1UdHwQ8MDowOKA2 +oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2Vydmlj +ZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Au +Y29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQCVNsca6XtKkyq+mV5Ob3qb +oYxAyfR90u4jmNm3a9r2dRoAaAtasRUfHOWGMIrHzUifmtT86/9Tiz0iY+zrvOVx +sZCrApeTGZeMOLr7F02vhXfeWIETzcAOmS9RPK2H5asuu0GtLl8P2cK9312XqD2v +k3UCrjRf/StRTQNQNLh1JjEob0+jQ2KU+Z6nI7+qZyebQ87uI6BegMRH80IvWYYw +Rj/rVPK6DTilQLTZ6wtoEMaBuiZ6ROt7UQGjeZsE2cvnqob7QmgaHgIdusRZT9pl +8SLrmvsyKx8UR8C/JE1WFezDdgDntFJeF5drgz+VkpwRUTzu7dg2+tttgrZyCZt7 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFBzCCA++gAwIBAgIRALIM7VUuMaC/NDp1KHQ76aswDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMjAxMTAwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFkxCzAJBgNVBAYTAkNOMSUwIwYDVQQKExxUcnVzdEFzaWEg +VGVjaG5vbG9naWVzLCBJbmMuMSMwIQYDVQQDExpUcnVzdEFzaWEgUlNBIERWIFRM +UyBDQSBHMjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKjGDe0GSaBs +Yl/VhMaTM6GhfR1TAt4mrhN8zfAMwEfLZth+N2ie5ULbW8YvSGzhqkDhGgSBlafm +qq05oeESrIJQyz24j7icGeGyIZ/jIChOOvjt4M8EVi3O0Se7E6RAgVYcX+QWVp5c +Sy+l7XrrtL/pDDL9Bngnq/DVfjCzm5ZYUb1PpyvYTP7trsV+yYOCNmmwQvB4yVjf +IIpHC1OcsPBntMUGeH1Eja4D+qJYhGOxX9kpa+2wTCW06L8T6OhkpJWYn5JYiht5 +8exjAR7b8Zi3DeG9oZO5o6Qvhl3f8uGU8lK1j9jCUN/18mI/5vZJ76i+hsgdlfZB +Rh5lmAQjD80M9TY+oD4MYUqB5XrigPfFAUwXFGehhlwCVw7y6+5kpbq/NpvM5Ba8 +SeQYUUuMA8RXpTtGlrrTPqJryfa55hTuX/ThhX4gcCVkbyujo0CYr+Uuc14IOyNY +1fD0/qORbllbgV41wiy/2ZUWZQUodqHWkjT1CwIMbQOY5jmrSYGBwwIDAQABo4IB +JjCCASIwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYE +FF86fBEQfgxncWHci6O1AANn9VccMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8E +CDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAiBgNVHSAE +GzAZMA0GCysGAQQBsjEBAgIxMAgGBmeBDAECATBDBgNVHR8EPDA6MDigNqA0hjJo +dHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNy +bDA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9k +b2NhLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAHMUom5cxIje2IiFU7mOCsBr2F6CY +eU5cyfQ/Aep9kAXYUDuWsaT85721JxeXFYkf4D/cgNd9+hxT8ZeDOJrn+ysqR7NO +2K9AdqTdIY2uZPKmvgHOkvH2gQD6jc05eSPOwdY/10IPvmpgUKaGOa/tyygL8Og4 +3tYyoHipMMnS4OiYKakDJny0XVuchIP7ZMKiP07Q3FIuSS4omzR77kmc75/6Q9dP +v4wa90UCOn1j6r7WhMmX3eT3Gsdj3WMe9bYD0AFuqa6MDyjIeXq08mVGraXiw73s +Zale8OMckn/BU3O/3aFNLHLfET2H2hT6Wb3nwxjpLIfXmSVcVd8A58XH0g== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIE/jCCA+agAwIBAgIQd0CowKgL8gjvFXZHp7O6tDANBgkqhkiG9w0BAQsFADB7 +MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD +VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE +AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTIyMDExMDAwMDAwMFoXDTI4 +MTIzMTIzNTk1OVowWTELMAkGA1UEBhMCQ04xJTAjBgNVBAoTHFRydXN0QXNpYSBU +ZWNobm9sb2dpZXMsIEluYy4xIzAhBgNVBAMTGlRydXN0QXNpYSBSU0EgRVYgVExT +IENBIEcyMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAl0bf+8vinEUT +bSABtIX/zRH52W8E0Y7XpNTdaB9tTG1qrwJ4dl9AuKXRCikxPIONs6bY+HxY7o/T +LzaOevI7yUlsXT0B5f/KWTR3np88yXwGhEVGeU5XIGe0Z85njzMz0koPIif5u7DR +YbHKKyPtVU2qFicGSONb5x81nMn721saeFveQjrUd7IdEmRraBQYINCjlTojv7EZ +3StDKb6qbCUAIPjgKXC91K3TNAGNRsvndKvUNI508YLqQThF7CZsADj5h9WUMRIH +Yo/AkVRCOUcVxx57fQJth0RPdPItGSjJLzgDuhddxNCwcyiz7EfYarVeH5JlixrZ ++mKTSpTxVSiaX5JX6QJ4qusOOWmuEIrDOvGB515EOkzF9rgGYpHNnlpbzxrvH26n +rUUQvGZNrxDa5N5p6BrbI5ntoUURmZu0m4hwruCqlO5mKHAt7C2krdoVdsAMC1wZ ++FLd9k3C8CpWmRfxmFcvT1PC7q9qAregQoLutTbi64HznRtPiCb7AgMBAAGjggEe +MIIBGjAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQU +PL6hrVi9RHJd/050WsN7lCeofIAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQI +MAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBoGA1UdIAQT +MBEwBgYEVR0gADAHBgVngQwBATBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3Js +LmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDA0BggrBgEF +BQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAN +BgkqhkiG9w0BAQsFAAOCAQEAdLbWKd69F2iFGbUra2BfwaFKXqzWNVD5asW8Tfrw +5K1U5h2N2GSyonEnTVc5JaTSbjloB4HSIct2OAz2HikM0fTNL45G/i3JJuluR8Pa +eSdcwNEIzZg8hBBZFSVhgY5rsRi5mvHNVngHn2LF82I5A+Arlud90ZDYj9AamRLA +U1BUNf31/jsjNJB+OsdPsrVjoqZYqhDZVEDNAwyZ52URULkNIiUjyhvMwjBwTPwN +dlRrQaASob0dwf8ZgNCtSBrlXMIh9oPqEhT0c8jWo4C4chRgviIubEOmpvIq8YHP +NBl3ouVRtpLe8xNwExAhJ9uRozfKpib5ahIj3TUenXOb3g== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFBzCCA++gAwIBAgIRAIjIlPomNnQ0gajkW/aGHc4wDQYJKoZIhvcNAQELBQAw +ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G +A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV +BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yMjAxMTAwMDAwMDBaFw0y +ODEyMzEyMzU5NTlaMFkxCzAJBgNVBAYTAkNOMSUwIwYDVQQKExxUcnVzdEFzaWEg +VGVjaG5vbG9naWVzLCBJbmMuMSMwIQYDVQQDExpUcnVzdEFzaWEgUlNBIE9WIFRM +UyBDQSBHMjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMMsv9Ae9mba +03+pEjRkDcT5/psaxSnRb1m11UkOo55ptSHNvD6ksa6h1ABuw/0n90bmj3aMJspG +1IQXkRBoVnB2BUmDGMUfscHFmOsnI0qJxKpwe6YAxyFJbzIjq8D7DShACNUKzypR +poBCoJKC3nSAqk+bkZ4qnmmd/FWl/K1EEcZHmJSFRkNm2V5Wiolithqeoulz9YCF +Um1/D4pwgheY5yp+SeiNF9lwM6eILUQ2Rdot/nx2vQ0WypVfrz0TgR/VBPtS1n6Y +LVO2awsQWYW2QjKzUVmk1wCHiTGQ8s6MlV35UcmycMJhS+lFxe6qPduxWrtbMGwJ +PyzPBEPt2mItBkQGQmJ6suT2w092ask0cpotSR6zPFLpiawsE5k9KXl2yOCGAHH1 +WtiDAqu1hyW/isrGD1VIYvXNrsDBngog97kl4gHQASDM1HuiG3j9d2Bao2BP3q4u +DI3GCJd468paeBDdkrQux+4tSO7eCoVbGnPFjUspEtMuMuNy5XD8JwIDAQABo4IB +JjCCASIwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYDVR0OBBYE +FMoxITcM3jm30istVZpcqalcUPomMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8E +CDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAiBgNVHSAE +GzAZMA0GCysGAQQBsjEBAgIxMAgGBmeBDAECAjBDBgNVHR8EPDA6MDigNqA0hjJo +dHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNy +bDA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9k +b2NhLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAdI/xWnHciaMYplkXi+20Ec5OLR1h +UwczrHpDCvWAob2Hl+NK1IpwO3y3ALjCXvFTPAEkNI/RFbNoxz2UiFQh946m4ggB +n77Dj35xu6TWgCeYnhc2R87EDLYS3UHxfg0fZY8Pvo4wm+Bqabx23aFESYDlk6fO +/VgvUzZ/GewYo78DGPNd/dcqjMSR0Ga0Q7BD+SeFbmzmPD1oRfIPKog4kDum95Ro +nt7m3K8cEjhEWZ6h3ZQ1Wrdi6oGdxMixhnE4b8X9tIflmVSoIdzSbsrIcaOvlkzv +nc9IKm8XQvqOewdx5x3Gfd8pzGr5JjGQEBzDXtArfKt4pbBk2j5b9FAjCA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- MIICOjCCAcCgAwIBAgIQFAP1q/s3ixdAW+JDsqXRxDAKBggqhkjOPQQDAzBOMQsw CQYDVQQGEwJVUzEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMSUwIwYDVQQDDBxT U0wuY29tIFRMUyBFQ0MgUm9vdCBDQSAyMDIyMB4XDTIyMDgyNTE2MzM0OFoXDTQ2 diff --git a/cert.db b/cert.db index 1890fb30..efa86b91 100644 Binary files a/cert.db and b/cert.db differ diff --git a/certdata/aaa_anchor_test.go b/certdata/aaa_anchor_test.go new file mode 100644 index 00000000..bdafff7c --- /dev/null +++ b/certdata/aaa_anchor_test.go @@ -0,0 +1,65 @@ +package main + +import ( + "crypto/sha256" + "crypto/x509" + "fmt" + "testing" +) + +// These intermediates are explicitly trusted so their paths can terminate +// without the distrusted AAA root. Fingerprints identify exact certificates, +// including the two COMODO certificates that share one public key. +func TestAAAOnlyIntermediatesAreTrustAnchors(t *testing.T) { + expected := map[string]string{ + "0b405cfe9a6beb098ffb969121c5f6710f3f7fa9ea101a6418f7af201d3d3938": "Apple Public Server RSA CA 12 - G1", + "0c37d499c45792941c62f1e19f06e9755625ce11633a2e8db869c7ab2d78c319": "TrustAsia RSA OV TLS CA G2", + "0d4d3a2f6dac222175ba1df78b4817b469095bf02f47919512353115902265fb": "TrustAsia ECC EV TLS CA G2", + "1286173e6f0102f7bdd32c2f830910953489bf22c16295d84dd90a3da137164a": "COMODO SHA-2 Pro Series Secure Server CA", + "38a7525022c9658caafc6060764fd51c6a5c5bef232d3e6c7e48af07a098df1e": "Comodo Japan RSA DV CA", + "3a739e1902626352c3337e94db2075998c456cf65c95f5a9632b12d0b7c89dcb": "TrustAsia RSA DV TLS CA G2", + "5251e2a5b3a42021667994b04e195b693b9b71b752267c44dc310a77979bdc00": "TrustAsia ECC DV TLS CA G2", + "70db9ded944dd35d474ea15ff2aa4e25f393a893ecda54359d305bc319649817": "Apple Public Server ECC CA 12 - G1", + "7f814cd1454900ac1331364b6b6de06b87cc8cb9936ec583100822721057d3a3": "Sectigo SHA-256 DV Secure Server CA", + "97a718082b78ee7480979b2116d4ba0215c61aaa520b46ca6b9c2ab378f40821": "Sectigo SHA-256 OV Secure Server CA", + "9a6962cd8c21b5dcf1f70b39a836c7f397ec495f880be9b9b69b8b27288ecb14": "KICA RSA OV CA", + "aafdcee5793b5cf4bf2d0c5f6042d8a422bcc33b3965ac6283d273cc69b48375": "Sectigo SHA-256 EV Secure Server CA", + "b0547fd468fbb6e337fe01b010834e53b4c5b12649ecee76faec38b8640f8878": "Sectigo RSA Pro Series Secure Server CA", + "d158333e02b10c80f6966b7705ab79570b17da38b1e392145940ed7e67ee4fd8": "TrustAsia RSA EV TLS CA G2", + "da4792604e554a3894efc97489cc4b64831b2cf7e5512b3395ef9963d6efdd7f": "TrustAsia ECC OV TLS CA G2", + "e11e06861c4d308fd944bf17be5e9072a034c4f93034cb59c02d512d30f7fc45": "COMODO SHA-2 Pro Series Secure Server CA", + "f606d8deb27c0401f34e7b6a37c8e2a51db8da026be58a07e854b686de74c69a": "KICA RSA DV CA", + } + + roots := x509.NewCertPool() + var anchors []*x509.Certificate + for _, cert := range loadBundle(t, caBundleFile) { + fingerprint := fmt.Sprintf("%x", sha256.Sum256(cert.Raw)) + name, found := expected[fingerprint] + if found == false { + continue + } + if cert.IsCA == false || cert.Issuer.CommonName != aaaRootCommonName { + t.Errorf("%q is not an AAA-issued CA", name) + } + roots.AddCert(cert) + anchors = append(anchors, cert) + delete(expected, fingerprint) + } + for fingerprint, name := range expected { + t.Errorf("%s is missing trust anchor %q (%s)", caBundleFile, name, fingerprint) + } + + for _, cert := range anchors { + chains, err := cert.Verify(x509.VerifyOptions{Roots: roots}) + if err != nil { + t.Errorf("%q cannot be trusted without AAA: %v", cert.Subject.CommonName, err) + continue + } + for _, chain := range chains { + if len(chain) != 1 { + t.Errorf("%q does not terminate directly at its configured anchor", cert.Subject.CommonName) + } + } + } +} diff --git a/certdata/ca-bundle.txt b/certdata/ca-bundle.txt index f8f7812f..9fda6113 100644 --- a/certdata/ca-bundle.txt +++ b/certdata/ca-bundle.txt @@ -3397,6 +3397,25 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE +Subject: /COMODO SHA-2 Pro Series Secure Server CA/C=GB/O=COMODO CA + Limited/L=Salford/ST=Greater Manchester +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA384 +Details: + Public key: RSA-2048 + Serial number: 184858721663017272285092440656930223752 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 80:B6:2B:0D:40:0A:0F:DF:3F:A4:BF:BF:03:F4:B1:76:6B:D5:E7:8F + Valid from: 2014-09-16T00:00:00+0000 + until: 2029-09-15T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /Microsoft Time Stamp Root Certificate Authority 2014/C=US/O=Microsoft Corporation/L=Redmond/ST=Washington Issuer: /Microsoft Time Stamp Root Certificate Authority 2014/C=US/O=Microsoft @@ -3470,6 +3489,25 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE +Subject: /COMODO SHA-2 Pro Series Secure Server CA/C=GB/O=COMODO CA + Limited/L=Salford/ST=Greater Manchester +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA384 +Details: + Public key: RSA-2048 + Serial number: 246883634746357637939162446578486023875 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 80:B6:2B:0D:40:0A:0F:DF:3F:A4:BF:BF:03:F4:B1:76:6B:D5:E7:8F + Valid from: 2015-02-12T00:00:00+0000 + until: 2030-02-11T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /UCA Extended Validation Root/C=CN/O=UniTrust Issuer: /UCA Extended Validation Root/C=CN/O=UniTrust Signature algorithm: RSA / SHA256 @@ -4467,6 +4505,25 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE +Subject: /Comodo Japan RSA DV CA/C=JP/O=Comodo Japan, + Inc./L=Chiyoda-ku/ST=Tokyo +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 118558298467631452769222351567230513713 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 21:91:01:CC:88:1F:B3:E6:2E:43:F4:7C:F1:30:89:8B:41:6C:1D:4A + Valid from: 2018-06-14T00:00:00+0000 + until: 2028-06-13T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /Digidentity Services Root CA/C=NL/O=Digidentity B.V. Issuer: /Digidentity Services Root CA/C=NL/O=Digidentity B.V. Signature algorithm: RSA / SHA256 @@ -4494,6 +4551,25 @@ Details: Basic constraints: valid, is a CA certificate, max path length 1 SANs (0): CERTIFICATE +Subject: /Sectigo RSA Pro Series Secure Server CA/C=GB/O=Sectigo + Limited/L=Salford/ST=Greater Manchester +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 27622012235424977087809069238306234677 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 81:C5:BA:1D:B3:02:7D:C1:BF:56:F1:68:0C:E8:07:86:9C:7A:80:C6 + Valid from: 2018-11-06T00:00:00+0000 + until: 2030-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /Telia Root CA v2/C=FI/O=Telia Finland Oyj Issuer: /Telia Root CA v2/C=FI/O=Telia Finland Oyj Signature algorithm: RSA / SHA256 @@ -4576,6 +4652,42 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE +Subject: /Apple Public Server ECC CA 12 - G1/C=US/O=Apple Inc./ST=California +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: ECDSA-prime256v1 + Serial number: 152062101864786254270275607527185217712 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 5F:E3:2E:8A:94:97:DE:D3:5C:E1:B7:D4:BC:98:8E:31:29:C9:90:3A + Valid from: 2019-06-19T00:00:00+0000 + until: 2028-12-06T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /Apple Public Server RSA CA 12 - G1/C=US/O=Apple Inc./ST=California +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 14479026799522096511860671249994321176 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 1E:5C:17:91:05:57:02:FC:77:5C:E3:70:43:EC:6B:FD:DD:D2:D8:69 + Valid from: 2019-06-19T00:00:00+0000 + until: 2028-12-06T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /Autoridade Certificadora Raiz Brasileira v10/C=BR/O=ICP-Brasil/OU=Instituto Nacional de Tecnologia da Informacao - ITI @@ -4785,6 +4897,96 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE +Subject: /Sectigo SHA-256 DV Secure Server CA/C=GB/O=Sectigo Limited +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 266016311018522150455829563466279248411 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 66:52:B8:65:2E:AA:B4:F2:41:7B:0A:74:FF:98:C2:03:68:E7:CE:80 + Valid from: 2020-04-01T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /Sectigo SHA-256 EV Secure Server CA/C=GB/O=Sectigo Limited +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 307961839245138452512505926569982412473 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 01:DB:94:A8:62:B4:60:08:53:95:F6:D4:A8:1E:FB:F6:04:A3:46:AA + Valid from: 2020-04-01T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /Sectigo SHA-256 OV Secure Server CA/C=GB/O=Sectigo Limited +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 302202452222994912622522195440533407321 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 62:15:1F:89:16:38:18:5E:34:EB:FA:DC:86:07:10:8A:D4:ED:56:6A + Valid from: 2020-04-01T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /KICA RSA DV CA/C=KR/O=KICA +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 105960198079834400438571125947849808061 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 00:B2:85:88:F1:A6:E5:F5:EF:82:25:04:4E:F9:65:CE:46:C1:11:0B + Valid from: 2020-05-27T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /KICA RSA OV CA/C=KR/O=KICA +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-2048 + Serial number: 85121046095479263451870928983159891601 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 00:59:CD:A0:BB:D2:92:F0:BE:EE:6F:52:8B:A9:CE:37:74:C1:20:48 + Valid from: 2020-05-27T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /ISRG Root X2/C=US/O=Internet Security Research Group Issuer: /ISRG Root X2/C=US/O=Internet Security Research Group Signature algorithm: ECDSA / SHA384 @@ -4880,6 +5082,114 @@ Details: Basic constraints: valid, is a CA certificate SANs (0): CERTIFICATE +Subject: /TrustAsia ECC DV TLS CA G2/C=CN/O=TrustAsia Technologies, Inc. +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: ECDSA-prime256v1 + Serial number: 279277416845205507684913506772718254861 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 01:A6:B0:FD:96:C7:4A:A8:69:22:B2:11:9E:60:DB:6A:34:C6:14:52 + Valid from: 2022-01-10T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /TrustAsia ECC EV TLS CA G2/C=CN/O=TrustAsia Technologies, Inc. +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: ECDSA-prime256v1 + Serial number: 52501319304020675217365520945744352240 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 37:64:23:A6:E3:D6:39:FA:CD:A6:C2:5C:8C:F0:4F:57:F2:DC:C3:F0 + Valid from: 2022-01-10T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /TrustAsia ECC OV TLS CA G2/C=CN/O=TrustAsia Technologies, Inc. +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: ECDSA-prime256v1 + Serial number: 171254659210531622743029271671596486219 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 87:F8:36:1E:A2:0C:CC:5F:74:94:58:DF:16:ED:09:FA:38:D9:C4:17 + Valid from: 2022-01-10T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /TrustAsia RSA DV TLS CA G2/C=CN/O=TrustAsia Technologies, Inc. +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-3072 + Serial number: 236669704491783629389451010103532317099 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 5F:3A:7C:11:10:7E:0C:67:71:61:DC:8B:A3:B5:00:03:67:F5:57:1C + Valid from: 2022-01-10T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /TrustAsia RSA EV TLS CA G2/C=CN/O=TrustAsia Technologies, Inc. +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-3072 + Serial number: 158513861205979756874655378547292748468 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: 3C:BE:A1:AD:58:BD:44:72:5D:FF:4E:74:5A:C3:7B:94:27:A8:7C:80 + Valid from: 2022-01-10T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE +Subject: /TrustAsia RSA OV TLS CA G2/C=CN/O=TrustAsia Technologies, Inc. +Issuer: /AAA Certificate Services/C=GB/O=Comodo CA + Limited/L=Salford/ST=Greater Manchester + Signature algorithm: RSA / SHA256 +Details: + Public key: RSA-3072 + Serial number: 181816488413943754384486977852475317710 + AKI: A0:11:0A:23:3E:96:F1:07:EC:E2:AF:29:EF:82:A5:7F:D0:30:A4:B4 + SKI: CA:31:21:37:0C:DE:39:B7:D2:2B:2D:55:9A:5C:A9:A9:5C:50:FA:26 + Valid from: 2022-01-10T00:00:00+0000 + until: 2028-12-31T23:59:59+0000 + Key usages: cert sign, crl sign, digital signature + Extended usages: client auth, server auth + Basic constraints: valid, is a CA certificate, max path length 0 + SANs (0): + OCSP server: + - http://ocsp.comodoca.com +CERTIFICATE Subject: /SSL.com TLS ECC Root CA 2022/C=US/O=SSL Corporation Issuer: /SSL.com TLS ECC Root CA 2022/C=US/O=SSL Corporation Signature algorithm: ECDSA / SHA384