[mitch292]

Summary

No keystore in ca-bundle.crt.metadata trusts either DigiCert TLS G5 root. That means compatible (ubiquitous) bundling currently anchors every G5 chain at a root that all modelled platforms score as untrusted.

This PR imports one cross-sign per G5 hierarchy into release 2026.10.2, so those chains anchor at the older DigiCert root. G2 and G3 are both trusted by the NSS, Windows, macOS, iOS and Ubuntu stores.

	RSA	ECC
Subject	DigiCert TLS RSA4096 Root G5	DigiCert TLS ECC P384 Root G5
Issuer	DigiCert Global Root G2	DigiCert Global Root G3
Serial	07A1278A2127F2B4C42170ECEC734B4E	0DF2A81F6BBE9A48DACFF728F67AB1FC
SHA-256	60c2666da5e2332170e1d3bfcd95bf8c9a6d4e63473f3a8bbb8cf42b3f9f038a	3142f99d358d9b500e5cdd2dff8f719a8ccecf589652334848522cca807d0807
Validity	2026-03-31 to 2036-03-30	2026-03-31 to 2036-03-30
EKU / policies	serverAuth, clientAuth / anyPolicy	serverAuth, clientAuth / anyPolicy

DigiCert has not issued a cross-sign from the ECC G5 root to G2. The only ECC cross-signs are issued by G3.

Why these cross-signs and not the others

CT shows several cross-signs for each G5 root. This PR adds exactly one per root, on purpose: if several were in the pool, ubiquitous selection would choose between them on tie-breakers alone. The others were rejected for these reasons:

• Revoked: the RSA cross-signs from 2023 (053BB5C8…, 0D6F6C9F…) were revoked 2026-05-15, according to the Global Root G2 CRL. The ECC cross-sign from 2022 (0DD88F3D…) is revoked according to the Global Root G3 CRL.
• Policy-restricted: the cross-signs issued 2026-06-10 restrict policies to EV/DV/OV, so they leave out IV.
• China endpoints: some RSA variants point their AIA and CRL at digicert.cn.

Neither added cert is on its issuer's current CRL (both CRLs last updated 2026-10-23). Each cross-sign has the same key as its G5 root, so clients that trust G5 directly still terminate there.

Impact

• Scope: only compatible-bundled chains under the two DigiCert TLS G5 roots. Optimal and force bundling, and all other hierarchies, are unchanged.
• Handshake size: affected chains grow by about 1.4 KB (RSA) or about 1 KB (ECC) per handshake.
• Private G5-only trust stores: clients that don't build alternate paths and use a private trust store containing only G5 would now look for G2/G3 and fail. OpenSSL 1.0.x without trusted-first is an example.
• Expiry: both cross-signs must be removed from the bundle before 2036-03-30.

Changes

• cert.db: both cross-signs imported into int release 2026.10.2. Bundles for earlier releases regenerate byte-for-byte unchanged.
• int-bundle.crt, certdata/int-bundle.txt: regenerated with cfssl-trust bundle / certdump. The diff contains only these two certificates, and ca-bundle.crt is unchanged.
• certdata/digicert_g5_cross_sign_test.go (table-driven over both hierarchies):
  • checks there is exactly one cross-sign per G5 root, pinned by fingerprint, that it shares the G5 key and that it is signed by the older root;
  • checks that ubiquitous chain ranking (platform ubiquity → SHA-2 homogeneity → chain length) anchors G5-issued CAs at the older root.

Testing

• go test ./... -count=1 and go vet ./certdata/ pass.
• Run against the previous int-bundle.crt, the new tests fail for each hierarchy as expected, for example anchors at "DigiCert TLS ECC P384 Root G5", want "DigiCert Global Root G3".
• Spot-checked RSA chain selection with cfssl v1.7.0's bundler.Bundle using the Ubiquitous flavor: DigiCert G5 TLS RSA4096 SHA384 2021 CA1 → [CA1, G5-by-G2], root G2.