Repository navigation
SECENG-13785: swap SSL.com Root 2022 intermediates to SecureTrust cross-signs - #399
Merged
Merged
Conversation
Replaces the SSL.com EV Root-issued Root 2022 intermediates in int-bundle.crt with the AAA Certificate Services cross-signed variants. This makes the pre-loaded path from an SSL.com-issued leaf terminate at Comodo's AAA root instead of SSL.com EV Root RSA R2 / ECC, restoring legacy-client coverage while keeping the intended chain (which was established in PR #396 by removing the AAA -> Transit R2 cross-signs). Removed from cert.db and int-bundle.crt / certdata/int-bundle.txt: - SSL.com TLS RSA Root CA 2022 issued by SSL.com EV Root Certification Authority RSA R2 serial 326F64E97034C6F7A3946A50A3ED04FE ski fb2e37eee3847a272ecd1935b1337cffd44442b9 - SSL.com TLS ECC Root CA 2022 issued by SSL.com EV Root Certification Authority ECC serial 3B0E701D53CBB71450A231960F41999C ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 Added: - SSL.com TLS RSA Root CA 2022 issued by AAA Certificate Services serial FFB282F728319B62BAF4B84F0DFE9339 ski fb2e37eee3847a272ecd1935b1337cffd44442b9 (same public key) - SSL.com TLS ECC Root CA 2022 issued by AAA Certificate Services serial 173DCA60EA9F8E1026DAFCD72810E48E ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 (same public key) The SSL.com EV Root Certification Authority RSA R2 and ECC roots remain in ca-bundle.crt for callers that still rely on them; only the Root 2022 intermediate variants used for path-building change. Produced via the documented flow: ./remove-cert.sh -s 326F64E9... -k fb2e37ee... -b int ./remove-cert.sh -s 3B0E701D... -k 898f2fa3... -b int NEW_INTERMEDIATES=NEW_INTERMEDIATES.pem NOGIT=1 ./release.sh New release: 2026.7.2 (intermediate + root).
dt-dtran
approved these changes
Aug 26, 2026
Take master's cert.db and bundles, dropping the AAA-cross-signed Root 2022 swap: AAA Certificate Services is distrusted as of database snapshot 2026.10.0.
…ss-signs AAA Certificate Services was distrusted in database snapshot 2026.10.0, so the AAA cross-signs this PR originally carried no longer give SSL.com chains a widely trusted anchor. SecureTrust CA is trusted by every modelled platform except Android 2.2 Froyo, and it has cross-signed both SSL.com Root 2022 keys. Replace the SSL.com EV Root-issued Root 2022 intermediates in database snapshot 2026.10.2, which has not been tagged yet, with the SecureTrust cross-signs. Earlier snapshots are unchanged, and future release rolls copy from 2026.10.2. Removed: - SSL.com TLS RSA Root CA 2022 issued by SSL.com EV Root Certification Authority RSA R2 serial 326F64E97034C6F7A3946A50A3ED04FE ski fb2e37eee3847a272ecd1935b1337cffd44442b9 - SSL.com TLS ECC Root CA 2022 issued by SSL.com EV Root Certification Authority ECC serial 3B0E701D53CBB71450A231960F41999C ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 Added: - SSL.com TLS RSA Root CA 2022 issued by SecureTrust CA serial 07EB4274FC1D305BE94C9883277F8467E2144F ski fb2e37eee3847a272ecd1935b1337cffd44442b9 (same public key) sha256 1b1de06990cd0b305e2e124806103b1adcffc499f212504dc77f48dd0ad62209 valid 2025-12-17 to 2029-12-30 - SSL.com TLS ECC Root CA 2022 issued by SecureTrust CA serial 07EB4281BE1A1011E552C13831E2947E9AF848 ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 (same public key) sha256 469a5624cbf125c29b1c73aa4d05d4b2bf4f8400b5d569e9a4ca554ab4c4faf5 valid 2025-12-17 to 2029-12-30 Neither cross-sign is on the current SecureTrust CA CRL. The cross-signs must be replaced before they expire on 2029-12-30. Add tests that each Root 2022 has exactly one non-self-signed copy, the SecureTrust cross-sign, and that ubiquitous chain selection anchors Root 2022-issued CAs at SecureTrust CA. Validation: go test ./... -count=1 and go vet ./certdata/
mitch292
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the SSL.com EV Root-issued SSL.com TLS {RSA,ECC} Root CA 2022 intermediates in
int-bundle.crtwith the copies cross-signed by SecureTrust CA. The pre-loaded path from an SSL.com-issued leaf then terminates at SecureTrust CA, which every modelled platform except Android 2.2 Froyo trusts. It no longer ends at the SSL.com EV roots.This PR originally swapped in the AAA Certificate Services cross-signs. AAA was distrusted in database snapshot 2026.10.0, so I merged master and took its bundles, which drops that swap. The net diff is now only the SecureTrust swap.
Changes are confined to database snapshot 2026.10.2, which is not tagged yet. Earlier snapshots are unchanged, and future release rolls copy from 2026.10.2.
Removed
326F64E97034C6F7A3946A50A3ED04FE3B0E701D53CBB71450A231960F41999CAdded
07EB4274FC1D305BE94C9883277F8467E2144F1b1de069…07EB4281BE1A1011E552C13831E2947E9AF848469a5624…fb2e37ee…and898f2fa3…).Tests (
certdata/sslcom_chain_test.go)int-bundle.crt. That copy is the SecureTrust cross-sign: the fingerprint matches, it has the same key, and its signature verifies against SecureTrust CA.Validation:
go test ./... -count=1,go vet ./certdata/.