Bug 296517 - secure/caroot: ePKI_Root_Certification_Authority.pem should be untrusted rather than trusted
Summary: secure/caroot: ePKI_Root_Certification_Authority.pem should be untrusted rath...
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: misc (show other bugs)
Version: 16.0-CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-04 15:45 UTC by Helge Oldach
Modified: 2026-07-04 17:08 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Helge Oldach 2026-07-04 15:45:00 UTC 
When manually updating certificates from the Mozilla NSS_3_123_1_RTM repo (in ${SRCTOP}/secure/caroot), I noticed that ePKI_Root_Certification_Authority.pem lands in the untrusted category. However, our git tree has it in the trusted subdirectory. Seems weird - is that intentional?
Comment 1 Helge Oldach 2026-07-04 16:44:49 UTC 
Ah, the certdata.txt pulled from Mozilla NSS_3_123_1_RTM says:

# Certificate "ePKI Root Certification Authority"
# For Server Distrust After: Tue Apr 15 23:59:59 2025

So this is a certificate that is now expired (but wasn't during the latest import). So we should regen, or import a more recent NSS.

FWIW, we also have

# Certificate "Izenpe.com"
# For Server Distrust After: Wed Apr 15 23:59:59 2026

in the import, which should be expired as well, however this cert still remains trusted for whatever reason. Maybe a text/octal mismatch in the pulled certdata.txt.
Comment 2 Helge Oldach 2026-07-04 17:08:58 UTC 
Ah, ca-extract.pl trusts expired certs for 398 more days, explaining the Izenpe.com case.