SECENG-13785: swap SSL.com Root 2022 intermediates to AAA cross-signs - #399
Open
mitch292 wants to merge 1 commit into
Open
SECENG-13785: swap SSL.com Root 2022 intermediates to AAA cross-signs#399mitch292 wants to merge 1 commit into
mitch292 wants to merge 1 commit into
Conversation
Replaces the SSL.com EV Root-issued Root 2022 intermediates in int-bundle.crt with the AAA Certificate Services cross-signed variants. This makes the pre-loaded path from an SSL.com-issued leaf terminate at Comodo's AAA root instead of SSL.com EV Root RSA R2 / ECC, restoring legacy-client coverage while keeping the intended chain (which was established in PR #396 by removing the AAA -> Transit R2 cross-signs). Removed from cert.db and int-bundle.crt / certdata/int-bundle.txt: - SSL.com TLS RSA Root CA 2022 issued by SSL.com EV Root Certification Authority RSA R2 serial 326F64E97034C6F7A3946A50A3ED04FE ski fb2e37eee3847a272ecd1935b1337cffd44442b9 - SSL.com TLS ECC Root CA 2022 issued by SSL.com EV Root Certification Authority ECC serial 3B0E701D53CBB71450A231960F41999C ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 Added: - SSL.com TLS RSA Root CA 2022 issued by AAA Certificate Services serial FFB282F728319B62BAF4B84F0DFE9339 ski fb2e37eee3847a272ecd1935b1337cffd44442b9 (same public key) - SSL.com TLS ECC Root CA 2022 issued by AAA Certificate Services serial 173DCA60EA9F8E1026DAFCD72810E48E ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 (same public key) The SSL.com EV Root Certification Authority RSA R2 and ECC roots remain in ca-bundle.crt for callers that still rely on them; only the Root 2022 intermediate variants used for path-building change. Produced via the documented flow: ./remove-cert.sh -s 326F64E9... -k fb2e37ee... -b int ./remove-cert.sh -s 3B0E701D... -k 898f2fa3... -b int NEW_INTERMEDIATES=NEW_INTERMEDIATES.pem NOGIT=1 ./release.sh New release: 2026.7.2 (intermediate + root).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the SSL.com EV Root-issued Root 2022 intermediates in int-bundle.crt with the AAA Certificate Services cross-signed variants. This makes the pre-loaded path from an SSL.com-issued leaf terminate at Comodo's AAA root instead of SSL.com EV Root RSA R2 / ECC, restoring legacy-client coverage while keeping the intended chain (which was established in PR #396 by removing the AAA -> Transit R2 cross-signs).
Removed from cert.db and int-bundle.crt / certdata/int-bundle.txt:
ski fb2e37eee3847a272ecd1935b1337cffd44442b9
Authority ECC
serial 3B0E701D53CBB71450A231960F41999C
ski 898f2fa3e82ba014547bf356b8265f67380b9cd0
Added:
ski fb2e37eee3847a272ecd1935b1337cffd44442b9 (same public key)
serial 173DCA60EA9F8E1026DAFCD72810E48E
ski 898f2fa3e82ba014547bf356b8265f67380b9cd0 (same public key)
The SSL.com EV Root Certification Authority RSA R2 and ECC roots remain in ca-bundle.crt for callers that still rely on them; only the Root 2022 intermediate variants used for path-building change.
Produced via the documented flow:
./remove-cert.sh -s 326F64E9... -k fb2e37ee... -b int
./remove-cert.sh -s 3B0E701D... -k 898f2fa3... -b int
NEW_INTERMEDIATES=NEW_INTERMEDIATES.pem NOGIT=1 ./release.sh
New release: 2026.7.2 (intermediate + root).
This will have the well known serve this example chain.
