Repository navigation
Remove dead-end intermediates from the current bundle - #415
Merged
Merged
Conversation
Remove 11 intermediates whose issuers are in neither bundle from database snapshot 2026.10.2, which has not been tagged yet. Earlier snapshots are unchanged, and future release rolls copy from 2026.10.2. Verifiers without issuer backtracking, such as BoringSSL, pick the first certificate matching an issuer's name. The StartCom Class 3 OV Server CA copy issued by WoSign G2 and the JCAN Public CA1 - G4 copy issued by Trusted Root CA SHA256 G2 can be selected ahead of their working copies, which then fail depending on bundle order. The working copies remain. The six emSign ECC G3 intermediates and three AAA-issued client authentication CAs lost their only issuer when those roots were distrusted, so they can no longer build a path. Validation: go test ./... -count=1 and go vet ./...
dt-dtran
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes 11 intermediates from
int-bundle.crt. None of them can reach a trusted root, because their issuers are in neither bundle.Why
Verifiers that don't backtrack during issuer selection (for example BoringSSL) take the first certificate in the store that matches the issuer name and key identifier. A dead-end copy listed before a working copy of the same CA makes verification depend on bundle order.
b4dae286)ea4e5d2b, so verification depends on order7b464dc3)9ac4c8e3, so verification depends on orderHow
intermediatestable for snapshot2026.10.2only. That snapshot was added in Add CA trust anchors for bundle compatibility #414 and hasn't been tagged yet. Update CA bundle path compatibility #412 made the same kind of change to the then-untagged2026.10.0snapshot.certificatestable are unchanged. Future release rolls copy from2026.10.2, so the removals carry forward.int-bundle.crtandcertdata/int-bundle.txtare regenerated withcfssl-trust -r 2026.10.2 -b int bundleandcertdump. The diff only deletes lines; nothing else changes.certdata/dead_end_intermediate_test.gofails if any of the 11 return, and also if the working StartCom or JCAN copy disappears.Validation
go test ./... -count=1andgo vet ./...pass.master'sint-bundle.crt, reporting all 11 certificates.int-bundle.crtis the previous bundle minus exactly these 11 certificates, by SHA-256.