Repository navigation
Add SSL.com-issued Entrust OV/EV TLS Issuing RSA CA 1 intermediates - #416
Merged
Merged
Conversation
…ates SSL.com now runs Entrust's public TLS hierarchy. It issues Entrust-branded leaves from Entrust OV TLS Issuing RSA CA 1 and Entrust EV TLS Issuing RSA CA 1, which chain to SSL.com TLS RSA Root CA 2022. int-bundle.crt only had the older Entrust Limited CA 2 intermediates, so compatible-mode bundling could not build a chain for these leaves. Import both into release 2026.10.2 from https://ssl.com/repo/certs/: - Entrust OV TLS Issuing RSA CA 1 sha256 345c0cf70370a56d465b8e6ed531b55cc8eb1da5b26880775c589a2f43358d83 - Entrust EV TLS Issuing RSA CA 1 sha256 d5612c7ed743b64cd8db432cedfea582608d4223f119eface7a6753534392ac8 Both are disclosed in CCADB, are not revoked, and are trusted by the Apple, Chrome, Microsoft, and Mozilla root programs. They expire 2027-08-22. The SSL.com TLS RSA Root CA 2022 root and its cross-sign, the third certificate requested in the issue, were already in the bundles. Add a test that both intermediates are in int-bundle.crt and chain to SSL.com TLS RSA Root CA 2022 in ca-bundle.crt. Fixes #308
lgarofalo
approved these changes
Oct 27, 2026
mitch292
added a commit
that referenced
this pull request
Oct 27, 2026
Resolve the cert.db conflict with #416 by taking master's database and re-importing both DigiCert G5 cross-signs into release 2026.10.2, then regenerating int-bundle.crt and certdata/int-bundle.txt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #308.
SSL.com now runs Entrust's public TLS hierarchy. It issues Entrust-branded leaves from Entrust OV TLS Issuing RSA CA 1 and Entrust EV TLS Issuing RSA CA 1, both issued by SSL.com TLS RSA Root CA 2022.
int-bundle.crtonly had the older Entrust Limited CA 2 intermediates, so compatible-mode bundling couldn't build a chain for these leaves.Changes
Both certificates were downloaded from https://ssl.com/repo/certs/ and imported into release 2026.10.2 with
cfssl-trust -b int -r 2026.10.2 import. The bundles andcertdumpoutput were then regenerated.6FE63EDE5FC1C03AFB6D7A85BD3A156D345c0cf7…358d83632EE520E05AFFBCCE19045824CC3678d5612c7e…392ac88faf7d2e…17f2ed), which is already inca-bundle.crt.SSLcom-TLS-Root-2022-RSA_cross.pem, is already inint-bundle.crt.ca-bundle.crtis unchanged.Adds
certdata/sslcom_entrust_intermediate_test.go, which asserts that both intermediates are present and chain to SSL.com TLS RSA Root CA 2022.Validation
go test ./... -count=1andgo vet ./certdata/pass.int-bundle.crt, the new test fails and reports both certificates as missing.